feat: reject auth servers lacking S256 PKCE support

[DaleSeo]

Motivation and Context

The client always sends an S256 PKCE challenge, but when the server's metadata advertised code_challenge_methods_supported without S256, validate_server_metadata only warned and continued. So rmcp would start a flow the server can't complete and fail confusingly mid-exchange. It now returns AuthError::PkceUnsupported up front for that case, matching the TypeScript SDK. A server that omits the field entirely is still allowed by default, and callers wanting the stricter spec behavior can opt in with set_require_pkce_support(true).

How Has This Been Tested?

New unit tests cover the matrix.

Breaking Changes

None. Only behavioral change.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed