fix: do not manually construct fallback authorization metadata

[alexhancock]

We should not manually guess and construct an authorization endpoint if we cannot discover metadata

Right now base_url is the MCP server's base url, not the authorization server

Surfaced to me through block/goose#5294

[Copilot]

Pull Request Overview

This PR improves OAuth security by removing the fallback mechanism that constructed default authorization endpoints when discovery fails. Instead of guessing endpoint URLs, the code now correctly returns a NoAuthorizationSupport error when OAuth metadata cannot be discovered from the server.

Key changes:

• Removed the fallback logic that constructed default OAuth endpoints (/authorize and /token) when metadata discovery failed
• Changed the behavior to return AuthError::NoAuthorizationSupport instead of constructing guessed endpoints
• Added clear comments explaining why OAuth endpoints must be discovered rather than constructed

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jamadeo]

I think this PR is correct in that we should not construct this metadata ourselves ever. It looks to me like #489 should fix the problem reported in the goose repo, as it adds support for discovery using resource metadata