feat: add positive tests for the Authorization Code Grant (supersedes #267)

[pcarleton]

Supersedes #267 by @Michito-Okai. Original commit cherry-picked with authorship preserved (5c8b78e), rebased onto current main (post-#227, post-#360), and followed by review fixes as separate commits.

What this adds

An authorization-code-grant scenario for the authorization subcommand: the tool acts as an OAuth client, runs the full code-grant flow (PKCE S256) against the AS under test via a loopback callback server, and validates the authorization and token responses against OAuth 2.1 §4.1.

New CLI options: --client-id, --client-secret (optional — public/PKCE-only clients supported), --port (default 3000). All composable with --file from #360.

Review fixes applied on top (each a separate commit)

• import type for AuthorizationServerOptions in types.ts (breaks a module cycle)
• --client-id / --client-secret made optional; --secret → --client-secret; port defaults to 3000 — restores metadata-only runs and enables public clients
• PKCE verifier/challenge generated per run (was the static RFC 7636 Appendix B vector)
• Authorization URL built with URLSearchParams; hardcoded resource=https://api.example.com/app/ dropped; redirect URI uses 127.0.0.1 per RFC 8252 §8.3
• token_endpoint_auth_methods_supported defaults to ['client_secret_basic'] per RFC 8414 §2 when omitted; none auth method supported; Basic credentials form-urlencoded per RFC 6749 §2.3.1
• Auth-method support check and SKIP decision moved before the interactive browser prompt
• ?error= checked before code; state mismatch is fatal (no token request fires); the code_challenge-in-response assertion dropped (no spec basis — OAuth 2.1 §4.1.2 says clients ignore unrecognized params)
• access_token / refresh_token / id_token masked in check.details (abcd…wxyz (len=N); fully redacted under 16 chars)
• Callback server: scoped to GET /callback, exposes close(), error handler for EADDRINUSE, timeout cleared on resolve; URL built from the bind address rather than the Host header
• Prints the exact redirect URI to register and the 5-minute timeout before the browser prompt

Left for follow-up (discussed on #267)

• Replacing the cross-scenario details state bag with a typed run-context or a shared metadata-fetch helper
• README section for the authorization subcommand
• CLI test harness (test: programmatic CLI harness for src/index.ts action handlers #363)

Closes #267. Closes #208.

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@modelcontextprotocol/conformance@364

commit: c58073e

[pcarleton]

See additional discussion in #267