Create lightweight local proxy for invoking IAM-protected Cloud Run services

When integrating private, IAM-protected Cloud Run services, developers need to provide a short-lived OIDC identity token in the Authorization header. One workaround is to start a local gcloud developer proxy, and then use `mcp-remote`. That's inconvenient, and we should provide a simpler way.

### Proposal: create mcp-run-proxy
Create a lightweight, standalone proxy tool, `mcp-run-proxy`, that transparently handles OIDC authentication for IAM-protected Cloud Run services.

The goal is to enable a configuration like this to work out-of-the-box:

```
{
"mcpServers": {
"my-tool-on-run": {
"command": "npx",
"args": [
"mcp-run-proxy",
"https://my-tool-service-abcdefgh-uc.a.run.app"
]
}
}
}
```

## How it Works (stdio proxy model)

When invoked by the MCP host:

1. **Launch:** The mcp-run-proxy is launched with the target Cloud Run URL as its only argument.
2. **Authentication:** It uses the developer's local [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials) to fetch an OIDC identity token, automatically using the providec Cloud Run service URL as the correct audience. It then holds this token in memory and sets a timer to refresh it before it expires.
4. Proxying via stdio: The tool listens for the MCP client's request payload on its standard input (stdin). When data is received, the proxy:
a. Initiates an HTTPS request to the target Cloud Run URL.
b. Attaches the valid, cached OIDC token to the `Authorization: Bearer ` header.
c. Forwards the request body received from stdin.
d. Streams the response from the Cloud Run service directly to its standard output (stdout), which is then read by the MCP client.

Start from the proposed mcp-run-proxy entry point and trace the stdin/stdout proxy model, Cloud Run URL argument, and Application Default Credentials flow described here. Done means a local invocation can obtain and refresh an OIDC token, forward MCP requests with the Authorization header, and stream responses for the shown npx configuration.

Written by the indexing model from the issue text.