When hitting a protected endpoint https://foo.com/mcp, we now query the integrated AS at https://foo.com/.well-known/oauth-authorization-server/mcp (w/ a fallback to just https://foo.com/.well-known/oauth-authorization-server).

BUT if there's an external AS defined in the PRM (e.g. if https://foo.com/.well-known/oauth-protected-resource returns {"authorization_servers":["https://some-auth.com"]...}), we currently sidestep the subpath logic and only hit https://some-auth.com/.well-known/oauth-authorization-server.

This change passes the auth server URL to discoverOAuthMetadata separately from the issuer URL (from which the subpath is to be fetched), and adds a test on auth itself that fails before the change.

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context