ext-auth: OAuth Client Credentials

[findleyr]

Investigate if we can/should add support for SEP-1046, an authorization extension. It has been finalized in https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx.

[jba]

This extension fits into our general framework, #591.

Our default implementation for that framework should support client ID and client secret as options, to handle that variant. Those were mentioned in my original design,#255. If those are set, our implementation would bypass dynamic client reservation. That is just a couple of lines of code, I believe.

We could also provide an implementation of JWT Assertions. I read that RFC a couple of times and it's still not clear to me what the API for that would look like. Perhaps we can take our lead from other SDKs, such as TypeScript.

[maciej-kisiel]

This should wait until client side OAuth scaffolding is ready (#785).