fix: pass client conformance suite

[DaleSeo]

Motivation and Context

This fixes OAuth client authorization-server discovery for path-based issuers, custom protected-resource metadata locations, and legacy servers that do not publish RFC 8414 metadata. It also fixes the remaining client conformance suite gaps around SSE retry handling and auth scope harness behavior. The change keeps metadata URL protections in place, allows loopback authorization servers only for loopback resources, and expands CI to run the full 2025-11-25 client conformance suite.

How Has This Been Tested?

Run cargo build -p mcp-conformance, then run npx -y @modelcontextprotocol/conformance@0.1.16 client --command "$(pwd)/target/debug/conformance-client" --suite all --spec-version 2025-11-25 and expect 222/222 checks to pass.

Breaking Changes

No breaking changes. This is a non-breaking client-side discovery fix.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed