feat(auth): add StateStore trait for pluggable OAuth state storage

[centdix]

This PR adds a pluggable StateStore for OAuth authorization state.

Motivation and Context

Problem
AuthorizationManager stores OAuth PKCE state in a private RwLock, making it impossible to use in load-balanced or serverless environments where the callback may hit a different server instance.

Solution
Add a StateStore trait that allows custom storage backends for OAuth state, mirroring the existing CredentialStore pattern.

How Has This Been Tested?

Tested and used for my own usage.

Breaking Changes

No breaking changes, default usage is still in the inMemory one.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Changes

• Add StoredAuthorizationState struct with serialization support
• Add StateStore trait with save/load/delete methods
• Add InMemoryStateStore as the default implementation
• Add set_state_store() method to AuthorizationManager
• State is now keyed by CSRF token, allowing concurrent auth flows

Usage

let mut manager = AuthorizationManager::new("https://api.example.com").await?;
manager.set_state_store(RedisStateStore::new(redis_client));