fix(auth): allow cross-origin resource_metadata urls

[DaleSeo]

Fixes #1298.

Motivation and Context

#935 added a same-origin requirement for the challenge's resource_metadata URL to block SSRF. But that also rejects a valid setup where one central protected resource metadata (PRM) host serves metadata for multiple resource servers, which RFC 9728 and SEP-985 allow. Discovery discarded the pointer before reading authorization_servers.

Now, a resource_metadata URL from a WWW-Authenticate challenge doesn't have to be on the same origin as the MCP resource. Instead, it goes through the same SSRF host check used for authorization server URLs.

How Has This Been Tested?

Add tests

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed