feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2)

[pcarleton]

Motivation and Context

This adds support for RFC 9728 (Protected Resource Metadata) in line with the latest draft spec https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location

How Has This Been Tested?

• Unit tests added for bearer authentication middleware with resource metadata support
• Integration example with both authorization server and protected resource server
• Tested example locally w/ inspector

Breaking Changes

This change should be strictly additive, adding an additional metadata endpoint, and extra information to the WWW-Authenticate headers.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

there is another PR that implements the client side of this here:
#416