confused deputy fix in example + supporting sdk changes

[pcarleton]

Motivation and Context

See the confused deputy consideration here:
https://github.com/modelcontextprotocol/modelcontextprotocol/blob/c255349bd98d9dc73f3579c828d195bd09c0bee8/docs/specification/draft/basic/security_best_practices.mdx#21-confused-deputy-problem

In the example, we front the Github API, so we need to put a consent screen for each new client registration, otherwise the Github consent screen will be skipped for new clients, creating a path for token leakage.

Still TODO:

• make the has_consent functions optional (currently every provider needs to implement them)
• allow overriding consent handler (currently always uses the default one)
• consider keeping consent handler abstract in the SDK, and putting example impl into the example directory

Here's what the consent screen looks like:

How Has This Been Tested?

Tested using inspector to run through auth flow

• w/ consent required
• w/o consent required

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pcarleton]

todo: check client_consent_required before doing this

[pcarleton]

todo: if client_consent_required, these need to be required, but otherwise they should be optional. open to suggestions here. i think a default implementation of return True means we'd solve for being optional, but not for required.

[felixweinberger]

Hey @pcarleton just checking whether we're still planning to ship this? Marking it as "needs publish" for now so we can easily filter it from views.

I also assume we might still need some merge conflict resolution here.