11-25-2025 compliant Auth (#651)

* fix: correct discovery for AS metadata

* fix: add commitlint to dev container

* feat: add RFC 8707 support for resource parameter

* feat: pkce method verification

* feat(auth): implement SEP-835 scope handling and 403 upgrade flow

- add WWWAuthenticateParams for parsing scope and resource_metadata from headers
- add ScopeUpgradeConfig and scope tracking in AuthorizationManager
- add InsufficientScopeError and 403 handling in streamable HTTP client
- add scope union computation for progressive authorization
- export new public types: AuthClient, ScopeUpgradeConfig, WWWAuthenticateParams

Co-authored-by: fizy069 <fizy069@users.noreply.github.com>

* fix: reorg auth tests

* feat: add error to www-authenticate header parsing

* feat: consider protected resource metadata in scope selection

* fix: reorganize auth tests

* feat: add examples and docs for updated auth

---------

Co-authored-by: fizy069 <fizy069@users.noreply.github.com>

examples/clients/src/auth/oauth_client.rs

@@ -114,14 +114,16 @@ async fn main() -> Result<()> {
         client_metadata_url
     );
 
-    // Initialize oauth state machine
+    // initialize oauth state machine
     let mut oauth_state = OAuthState::new(&server_url, None)
         .await
         .context("Failed to initialize oauth state machine")?;
-    // Use CIMD (SEP-991) with client metadata URL
+    // use CIMD (SEP-991) with client metadata URL.
+    // passing empty scopes lets the SDK auto-select from the server's
+    // WWW-Authenticate header, Protected Resource Metadata, or AS metadata.
     oauth_state
         .start_authorization_with_metadata_url(
-            &["mcp", "profile", "email"],
+            &[],
             MCP_REDIRECT_URI,
             Some("Test MCP Client"),
             Some(&client_metadata_url),