Fix OAuth protected-resource discovery for GitHub Copilot MCP

[patvice]

Summary

• implement MCP 2025-11-25 compliant protected-resource discovery order (path-based endpoint first, then root)
• support delegated authorization servers from authorization_servers and RFC 8414/OIDC metadata endpoint fallback ordering
• validate resource/issuer matching during discovery and keep challenge-provided resource_metadata context through auth flows
• harden OAuth challenge handling in SSE and StreamableHTTP transports with retry-loop guards and better diagnostics
• add focused specs covering protected-resource discovery, URL ordering, issuer/resource validation, and transport OAuth challenge retries
• add a runnable verifier script at scripts/test_github_copilot_mcp_oauth_tool.rb to authenticate, list tools, and execute one tool against GitHub Copilot MCP

Validation

• bundle exec ruby scripts/verify_github_copilot_mcp_auth.rb
• bundle exec rspec spec/ruby_llm/mcp/auth/discoverer_spec.rb spec/ruby_llm/mcp/auth/url_builder_spec.rb spec/ruby_llm/mcp/native/transports/streamable_http_spec.rb

Issue

Closes #117