feat: add conformance tests for iss parameter (SEP-2468)

[max-stytch]

Motivation and Context

Adds 5 draft conformance scenarios testing RFC 9207 issuer parameter validation in OAuth authorization responses:

• auth/iss-supported: server advertises support and sends correct iss
• auth/iss-not-advertised: server omits iss parameter entirely
• auth/iss-supported-missing: client must reject missing iss when required
• auth/iss-wrong-issuer: client must reject mismatched iss value
• auth/iss-unexpected: client must reject iss when not advertised

Also adds auth-test-iss-validation.ts, a reference client that correctly validates iss per RFC 9207, and negative tests confirming the standard client fails all three rejection scenarios.

TODO: Update RFC_9207_ISS_PARAMETER spec reference once SEP-2468 (modelcontextprotocol/modelcontextprotocol#2468) is merged.

How Has This Been Tested?

CI/CD

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[max-stytch]

Conformance tests were ran against modelcontextprotocol/go-sdk#859 locally for verification purposes:

./scripts/client-conformance.sh --conformance_repo /Users/mgerber/stytch/conformance --suite draft

=== SUITE SUMMARY ===

✓ auth/resource-mismatch: 3 passed, 0 failed
✗ auth/offline-access-scope: 0 passed, 1 failed
✗ auth/offline-access-not-supported: 0 passed, 1 failed
✓ auth/iss-supported: 15 passed, 0 failed
✓ auth/iss-not-advertised: 15 passed, 0 failed
✓ auth/iss-supported-missing: 7 passed, 0 failed
✓ auth/iss-wrong-issuer: 7 passed, 0 failed
✓ auth/iss-unexpected: 7 passed, 0 failed

Total: 54 passed, 2 failed, 0 warnings

[max-stytch]

I wanted to have one scenario with many checks, but it looks like the pattern is one scenario -> one auth server, and we need a separate AS for each check :/

[max-stytch]

I would have loved to add this behavior to the base ConformanceOAuthProvider, but it looks like that provider doesn't have access to the AS Metadata currently, so it is not possible for us to do the checks there. runCrossAppAccessCompleteFlow similarly needs to fetch the metadata itself.

Defer to maintainers on how best to incorporate this code.

[pcarleton]

Thanks for this — I've opened max-stytch#1 stacked on top of this branch with review fixes (one commit per finding, take or leave each). Coverage table and the rebase-onto-main note are in that PR's body.

Re auth-test-iss-validation.ts: don't sweat it — we're moving the example clients out of this repo soon, so it'll get reworked regardless.