fix(auth): honor explicitly configured OAuth resource indicators

[tsarlandie-oai]

Summary

• Add AuthorizationManager::set_resource(Option<&str>) for applications that need to configure an explicit OAuth 2.0 resource indicator.
• Use the configured audience consistently in the authorization URL, authorization-code exchange, and refresh-token requests.
• Give explicit configuration precedence over protected-resource metadata while preserving the existing discovered-resource and MCP-endpoint fallbacks.
• Reject relative URLs, unsupported schemes, missing hosts, and URI fragments without replacing a previously valid configuration.
• Restore the normal discovered-resource behavior when the override is cleared.

Motivation

Applications sometimes know the required RFC 8707 resource audience before starting authorization, and that audience can differ from the MCP endpoint or the resource published in metadata. Without an SDK-level configuration API, downstream clients may append a resource parameter to the authorization URL while authorization-code exchange and refresh continue to use a different SDK-selected audience. That can produce duplicate resource parameters, inconsistent token audiences, or failed refreshes.

Keeping audience selection inside AuthorizationManager applies one validated value across the complete OAuth lifecycle. When no override is configured, existing behavior is unchanged.

This change is independent of #1110: it targets current main and does not depend on or modify cached-credential issuer/resource binding.

Regression coverage

• End-to-end protected-resource discovery, authorization, authorization-code exchange, and token refresh with both discovered and explicitly configured audiences.
• Invalid relative, non-HTTP(S), fragment-bearing, and hostless resource indicators.
• Preservation of the previous valid audience after rejected configuration.
• Restoring the discovered audience after clearing an explicit override.

Validation

• cargo test --offline -p rmcp --features auth --lib transport::auth::tests — 177 passed.
• cargo test --offline -p rmcp --features auth-client-credentials-jwt --lib transport::auth::tests — 183 passed.
• cargo clippy --offline -p rmcp --all-targets --all-features -- -D warnings.
• rustfmt --check --edition 2024 crates/rmcp/src/transport/auth.rs.
• git diff --check.