Add explicit addition of scopes_supported

[gching]

Changes

As defined by RFC9728, the resource metadata supports optionally scopes_supported

We add support for this explicitly with the Clerk protected resource handler to be provided

Why?

Even though it is optional, I've noticed from testing that currently, mcp-tools does not work for dynamic client registration + oauth flow for VS Code since internally it dynamically registers the client with the scopes of the resource only. Because nothing is returned for scopes, Clerk setups up the default of email and profile for the client. However, when VS code submits an auth request, it uses the scopes from the auth server ie. openid, and fails since the client does not support this scope.

I think VS Code needs fix this logic internally, but for now, by providing the scopes_supported, this will make VS Code work properly and registers the client with the correct scopes and uses the client scopes for auth

[jescalan]

Have been recommending this through the general purpose properties array in the docs but I'm all for adding it more explicitly as well. Thanks Gavin!