Add auth regression test for missing resource in PRM

[Copilot]

The auth flow lacked coverage for client-side validation when the PRM document omits resource, which should still cause authentication failure even if the OAuth server is permissive.

• Test OAuth server toggle
  • Add RequireResource flag to bypass server-side resource validation when needed.
• Auth test coverage
  • Emit PRM without resource via OnResourceMetadataRequest and assert client-side rejection.

options.Events.OnResourceMetadataRequest = async context =>
{
    context.HandleResponse();
    var metadata = new ProtectedResourceMetadata
    {
        AuthorizationServers = { new Uri(OAuthServerUrl) },
        ScopesSupported = ["mcp:tools"],
    };
    await Results.Json(metadata, McpJsonUtilities.DefaultOptions).ExecuteAsync(context.HttpContext);
};

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[halter73]

I think it's good to make sure we have a regression test against anyone removing the validation in ClientOAuthProvider.GetRequiredResourceUri for reasons I explained in https://github.com/modelcontextprotocol/csharp-sdk/pull/1262/changes#r2800287979