Add application_type to the Dynamic Client Registration request

[jayaraman-venkatesan]

Fixes #1545

Implements SEP-837 — adds application_type to the Dynamic Client Registration request when the C# SDK registers against an OIDC-flavored authorization server.

Summary

Without application_type, an OIDC AS applies its spec-mandated default. This PR makes the SDK supply the correct value.

What happens in the changes

When the caller does set DynamicClientRegistrationOptions.ApplicationType explicitly, the value is cross-checked against the inferred type at ClientOAuthProvider construction time. A conflict (for example "web" paired with a localhost redirect URI) throws ArgumentException synchronously, before any HTTP request is sent

What changed

src/ModelContextProtocol.Core/Authentication/

• DynamicClientRegistrationRequest.cs — adds the application_type field on the wire DTO.
• DynamicClientRegistrationOptions.cs — adds the ApplicationType setter so callers can opt out of inference and force a specific value.
• ClientOAuthProvider.cs — resolution happens once, in the constructor:
  • Reads the explicit value from options.
  • Calls a private static InferApplicationType(Uri redirectUri) helper (mirrors Go sdk's inferApplicationType`).
  • Throws ArgumentException on conflict; otherwise stores the resolved value and writes it back onto options.DynamicClientRegistration.ApplicationType so callers can observe what was selected.
  • The DCR request initializer just reads the stored value at HTTP time.

tests/ModelContextProtocol.Tests/Authentication/ClientOAuthProviderApplicationTypeTests.cs (new)

• 5 inferred-value tests — localhost, 127.0.0.1, [::1], custom scheme, https remote.
• 2 explicit-match-preserved tests — explicit value that agrees with inference is kept.
• 2 conflict-throws tests — exact full exception message asserted, including (Parameter 'options').

Contract changes

• New nullable property on DynamicClientRegistrationOptions: ApplicationType { get; set; }. Backwards-compatible — existing callers default to null and now get an inferred value where they previously got nothing on the wire.
• New throw at construction: ClientOAuthProvider (constructed via HttpClientTransport) now throws ArgumentException when an explicit ApplicationType conflicts with the redirect URI shape.
• Mutation of caller's options: the constructor writes the resolved ApplicationType back to options.DynamicClientRegistration.ApplicationType. This is documented in the xmldoc and mirrors Go's behavior.

Test plan

• dotnet build src/ModelContextProtocol.Core — 0 warnings, 0 errors.
• dotnet test tests/ModelContextProtocol.Tests (net10.0) — 1969 passed, 0 failed, 5 skipped
• New ClientOAuthProviderApplicationTypeTests — 9/9 pass, including exact-message assertion on the conflict throw.

[jayaraman-venkatesan]

@mikekistler - can you please help reviewing this PR