Support confidential OAuth clients for enterprise-managed MCP auth (#56001)

## Why

Enterprise-managed MCP authentication previously required public OAuth clients at both the identity provider and the MCP authorization server, preventing use of registrations that require client secrets.

## What changed

- Accept separate `client_secret` and `token_endpoint_auth_method` settings for the enterprise IdP and MCP server OAuth registration. Support `client_secret_basic` and `client_secret_post`, defaulting to Basic when a secret is configured.
- Validate the registered method against server metadata and use it for enterprise login and both ID-JAG exchanges.
- Require a configured `oauth.authorization_server_issuer` for confidential MCP registrations and reject empty secrets or authentication methods without secrets.
- Require the account OAuth client to match the configured IdP client before reusing an account grant with a provisioned secret; otherwise use dedicated enterprise login.

## Testing

Extend configuration, login, exchange, and app-server lifecycle tests to cover confidential registrations, separate IdP and resource credentials, authentication method validation, and exclusion of client secrets from authorization URLs, stored login grants, and logs.

GitOrigin-RevId: b3be378c2b1bb67e6a3652c648e72fd2e21e956d

codex-rs/app-server/src/request_processors/mcp_processor.rs

@@ -230,6 +230,8 @@ impl McpRequestProcessor {
                         credential_name: &credential_name,
                         issuer: &idp.issuer,
                         client_id: &idp.client_id,
+                        client_secret: idp.client_secret.as_ref().map(|secret| secret.as_str()),
+                        token_endpoint_auth_method: idp.token_endpoint_auth_method,
                         keyring_backend_kind: mcp_config.auth_keyring_backend_kind,
                         callback_port: mcp_config.mcp_oauth_callback_port,
                         callback_url: mcp_config.mcp_oauth_callback_url.as_deref(),