#2862 Add OIDC fallback for legacy OAuth discovery

Summary

• Add OIDC discovery as a fallback when protected resource metadata discovery fails and the client falls back to the MCP server origin for authorization-server metadata.
• Keep the existing OAuth metadata probe first, then try /.well-known/openid-configuration for OIDC-only providers.
• Add regression coverage at both the URL-builder/auth-flow level and the interaction discovery harness.

Fixes #1785.

Verification

• uv run --frozen pytest tests/interaction/auth/test_discovery.py::test_when_every_prm_probe_fails_the_client_discovers_as_metadata_at_the_server_origin tests/client/test_auth.py::test_oauth_flow_discovers_oidc_metadata_when_prm_is_absent tests/client/test_auth.py::TestOAuthFallback::test_oauth_discovery_legacy_fallback_when_no_prm -q
• uv run --frozen ruff check tests/interaction/auth/test_discovery.py src/mcp/client/auth/utils.py tests/client/test_auth.py && uv run --frozen ruff format --check tests/interaction/auth/test_discovery.py src/mcp/client/auth/utils.py tests/client/test_auth.py
• uv run --frozen pyright tests/interaction/auth/test_discovery.py tests/client/test_auth.py src/mcp/client/auth/utils.py
• ./scripts/test (1781 passed, 5 skipped, 1 xfailed, 100% coverage, strict-no-cover clean)
• uv run --frozen ruff check . && uv run --frozen ruff format --check .
• uv run --frozen pyright

Review

• Local Codex review of final diff: CLEAN
• Hermes subagent code review of pre-integration-test diff: clean