fix(client): accept OAuth servers without response issuer support

[kauandotnet]

Summary

• accept authorization servers that omit optional RFC 9207 response issuer support
• require an exact callback issuer when advertised and reject mismatches whenever supplied
• preserve PKCE, state, resource, issuer, and endpoint pinning

Verification

• pnpm --filter @nestm/mcp-client test
• pnpm --filter @nestm/mcp-client run lint
• pnpm --filter @nestm/mcp-client run typecheck
• pnpm --filter @nestm/mcp-client run verify:pack
• pnpm run check
• live bootstrap discovery against the Zoho MCP returns ready