[codex] Support protected resource OAuth discovery

[xl-openai]

Why

Plugin-install preflight and the actual OAuth login flow used different discovery implementations. Preflight had a Codex-specific implementation that only queried authorization-server metadata on the MCP host, while login already used the upstream rmcp Rust MCP SDK. As a result, servers that advertise a separate authorization server through RFC 9728 Protected Resource Metadata were classified as OAuth-unsupported during plugin installation, so login was skipped.

What changed

• delegate plugin-install OAuth discovery to rmcp::transport::AuthorizationManager, the same implementation used by the login flow
• let rmcp follow Protected Resource Metadata first and perform direct RFC 8414 authorization-server discovery when protected-resource discovery does not yield usable metadata
• retain Codex's existing HTTP headers, timeout, no_proxy behavior, and scope normalization around that discovery
• add unit coverage and a pure-MCP plugin-install integration test that proves the protected-resource path reaches OAuth client registration

This only changes shared MCP OAuth discovery. App declarations and appsNeedingAuth behavior are unchanged.

Verification

• just test -p codex-rmcp-client auth_status
• just test -p codex-app-server plugin_install_starts_mcp_oauth
• real plugin-install smoke test with an isolated CODEX_HOME: both DigitalOcean MCP servers started OAuth callback listeners, while Linear continued to start its existing direct-discovery OAuth flow