auth: issuer mix-up mitigation

[max-stytch]

This PR functions as a Reference implementation of SEP-2468 / RFC9207.

This PR hardens the MCP OAuth Client functionality against Mix-Up attacks:

Mix-up attacks aim to steal an authorization code or access token by
tricking the client into sending the authorization code or access
token to the attacker instead of the honest authorization or resource
server

This PR hardens the client by adding support for a new iss parameter in authorization responses:

• Authorization Servers broadcast support for the iss parameter via the authorization_response_iss_parameter_supported metadata parameter
• If the parameter is supported, clients expect to receive the iss parameter in the authorization response
• Clients compare the iss parameter in the authorization response to the Issuer parameter in the authorization metadata. The two must match exactly for the response to be processed.