Allow custom HTTP clients for OAuth

[jif-oai]

Why

RMCP currently performs OAuth network operations through internally created reqwest clients. Callers therefore cannot route OAuth through another network environment, even when their MCP HTTP transport supports it.

What changed

• Add one injectable OAuth HTTP client boundary.
• Route protected-resource discovery, OAuth/OIDC discovery, dynamic registration, code exchange, refresh, and client credentials through it.
• Keep reqwest as the default for existing callers.
• Preserve the injected client across OAuth state transitions.
• Expose timeout and redirect requirements with each request so token operations can disable redirects.
• Add focused fake-client coverage for discovery, registration, exchange, and refresh.