Add OAuth2 Client ID Metadata Document support

MCP connectors such as ChatGPT and Claude register via HTTPS
client_id URLs instead of pre-provisioned GIDs. Fetch and cache
their metadata documents, upsert clients on first use, and
advertise CIMD in OIDC discovery when allowed URLs are configured.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/probod/probod.go

@@ -1422,5 +1422,9 @@ func oauth2ServerOptions(cfg OAuth2ServerConfig) []oauth2.Option {
 		opts = append(opts, oauth2.WithDeviceCodeDuration(time.Duration(cfg.DeviceCodeDuration)*time.Second))
 	}
 
+	if len(cfg.CIMDAllowedClientIDs) > 0 {
+		opts = append(opts, oauth2.WithCIMDAllowedClientIDs(cfg.CIMDAllowedClientIDs))
+	}
+
 	return opts
 }