feat: expose oauth discovery metadata source

[DaleSeo]

Closes #1037

Motivation and Context

AuthorizationManager::discover_metadata() falls back to the legacy default endpoints, /authorize, /token, and /register, based on the base URL when discovery returns nothing. This fallback is required for the auth/2025-03-26-oauth-endpoint-fallback conformance scenario. However, it makes a successful fallback look the same as metadata that the server actually published. As a result, callers that use discovery to determine whether a server supports OAuth can no longer receive a NoAuthorizationSupport-style signal. That behavior was originally introduced in #507 and changed by #960.

This implements Option A from the issue: a new discover_metadata_with_source() method returns the metadata together with an AuthorizationMetadataSource, plus an is_discovered() helper. discover_metadata() now delegates to it and its docs point callers that need capability detection to the new method. Existing behavior and the conformance scenario are untouched.

How Has This Been Tested?

Unit tests cover all three sources

Breaking Changes

None

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed