This is an attempt to merge #531 and #552

Motivation and Context

This merges two sets of OAuth changes:

• PR Allow OAuth client provider to implement token endpoint authentication methods #531 (@jaredhanson): Adds extensible authentication via OAuthClientProvider.addClientAuthentication callback (renamed from PR's proposed authToTokenEndpoint) for custom auth methods
• PR Add client_secret_basic and none authentication methods #552 (@SightStudio): Adds built-in support for standard OAuth 2.1 authentication methods (client_secret_basic, none)

How Has This Been Tested?

WIP: testing in inspector

Breaking Changes

n/a

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• Main changes from McpError: MCP error -32601: Method not found #415:
  • Renamed callback to addClientAuthentication
  • Passed callback explicitly to refreshAuthorization & exchangeAuthorization, to avoid the awkwardness of them accepting a provider + other redundant parameters (codeVerifier, redirectUri)