Add OAuth2 Client ID Metadata Document support

MCP connectors such as ChatGPT and Claude register via HTTPS
client_id URLs instead of pre-provisioned GIDs. Fetch and cache
their metadata documents, upsert clients on first use, and
advertise CIMD in OIDC discovery when allowed URLs are configured.

Signed-off-by: Bryan Frimin <bryan@probo.com>

e2e/console/oauth2_test.go

@@ -96,6 +96,7 @@ func TestOAuth2_Discovery(t *testing.T) {
 	assert.Contains(t, discovery.ClaimsSupported, "email")
 	assert.Contains(t, discovery.ClaimsSupported, "email_verified")
 	assert.Contains(t, discovery.ClaimsSupported, "name")
+	assert.True(t, discovery.ClientIDMetadataDocumentSupported)
 }
 
 func TestOAuth2_ProtectedResourceMetadata(t *testing.T) {

e2e/internal/testutil/oauth2.go

@@ -97,6 +97,7 @@ type (
 		CodeChallengeMethodsSupported             []string `json:"code_challenge_methods_supported"`
 		ClaimsSupported                           []string `json:"claims_supported"`
 		ProtectedResources                        []string `json:"protected_resources,omitempty"`
+		ClientIDMetadataDocumentSupported         bool     `json:"client_id_metadata_document_supported"`
 	}
 
 	OAuth2ProtectedResourceMetadataResponse struct {