feat: use scopes_supported from resource metadata by default (fixes #580)

[antogyn]

If available, all scopes in the field scopes_supported from /.well-known/oauth-protected-resource are used by default in:

• DCR
• the authorization url

Motivation and Context

See #580

How Has This Been Tested?

I tested this on a custom build of mcp-remote and it works well for the authorization endpoint

I didn't test DCR though because it's not available in my setup, but if you have a suggestion to test it I can do that too

Breaking Changes

It can technically be breaking since the default value is different

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[pcarleton]

Overall this change looks good (And consistent with SEP-835), but it has some conflicts with the main branch. if you're able to resolve those, we can merge this in.

[antogyn]

Done, thanks for taking a look at this