fix(auth): refresh with granted scopes

[jstar0]

Summary

Send only the scopes recorded in the stored grant on OAuth refresh. Authorization and 403 scope-upgrade requests continue to add offline_access when supported.

Fixes #1330

Testing

• cargo test -p rmcp --features "auth transport-io" passed: 417 unit tests and 39 doctests; 9 doctests and 4 live Keycloak tests were ignored as configured.
• cargo +nightly fmt --all -- --check passed.
• cargo clippy -p rmcp --features auth --lib passed with three existing dead_code warnings.

[jstar0]

All relevant checks now pass on head 18f9856. Could a maintainer review the OAuth refresh-scope fix when convenient? I am happy to address any feedback.

[DaleSeo]

I left a couple of small suggestions. Nothing blocking.

[DaleSeo]

The test token server leaves scope out of its response, so resolve_granted_scopes falls back to requested_scopes. That means the old code also saved the ungranted offline_access scope in granted_scopes, which caused every later refresh to fail. Can we assert what gets saved to the credential store too?

[DaleSeo]

granted_scopes is cloned into a new Vec, and then each element is cloned again. So the resolve_granted_scopes call below can take requested_scopes directly instead of &requested_scopes.

Suggested change

	let requested_scopes = stored_credentials.granted_scopes.clone();
	for scope in requested_scopes.iter().cloned() {
	refresh_request = refresh_request.add_scope(Scope::new(scope));
	}
	let requested_scopes = &stored_credentials.granted_scopes;
	refresh_request =
	refresh_request.add_scopes(requested_scopes.iter().cloned().map(Scope::new));