[Bug] SecuritySchemeScopes cannot parse ProtoJSON format {"list":[...]} required by A2A v1.0 spec (ADR-001)

## Bug Description

`SecuritySchemeScopes` is defined as `type SecuritySchemeScopes []string`, which only handles bare JSON arrays like `["scope1"]`. However, per A2A v1.0 spec and [ADR-001](https://github.com/a2aproject/A2A/blob/main/adrs/adr-001-protojson-serialization.md), all JSON serialization MUST follow ProtoJSON specification.

In proto, `SecurityRequirement.schemes` is `map` where `StringList` is a message:

```proto
message StringList {
repeated string list = 1;
}
message SecurityRequirement {
map schemes = 1;
}
```

ProtoJSON serializes `StringList{list: ["openid"]}` as `{"list": ["openid"]}`, **not** as a bare array `["openid"]`.

The A2A v1.0 specification doc (`docs/specification.md` line 2176) also explicitly uses this format in its sample Agent Card:

```json
"securityRequirements": [{ "schemes": { "google": { "list": ["openid", "profile", "email"] } } }]
```

## Reproduction

Any A2A v1.0 compliant server that correctly implements ProtoJSON serialization will produce `{"list": [...]}` for security scopes. Parsing such an Agent Card with this SDK fails:

```go
protoJSON := `[{"schemes":{"appKey":{"list":[]}}}]`
var opts a2a.SecurityRequirementsOptions
err := json.Unmarshal([]byte(protoJSON), &opts)
// Error: json: cannot unmarshal object into Go struct field
// securityRequirements.schemes of type a2a.SecuritySchemeScopes
```

## Expected Behavior

`SecuritySchemeScopes.UnmarshalJSON` should accept both formats:
- ProtoJSON format: `{"list": ["scope1"]}` ← required by spec
- Bare array: `["scope1"]` ← backwards compat

## Suggested Fix

```go
func (s *SecuritySchemeScopes) UnmarshalJSON(b []byte) error {
var arr []string
if err := json.Unmarshal(b, &arr); err == nil {
*s = arr
return nil
}
var wrapper struct {
List []string `json:"list"`
}
if err := json.Unmarshal(b, &wrapper); err != nil {
return err
}
*s = wrapper.List
return nil
}
```

## References

- [ADR-001: ProtoJSON serialization](https://github.com/a2aproject/A2A/blob/main/adrs/adr-001-protojson-serialization.md)
- A2A v1.0 `docs/specification.md` sample Agent Card (line 2176)
- `specification/a2a.proto`: `message SecurityRequirement` / `message StringList`

## Environment

- a2a-go SDK: v2.5.0
- A2A spec: v1.0.1

The issue is in the `SecuritySchemeScopes` type's `UnmarshalJSON` method. Look at the file where this type is defined, likely in the SDK's core package. The fix involves modifying that method to accept both a bare JSON array and the ProtoJSON wrapper object format `{"list": [...]}`. Test by creating a small Go program that unmarshals sample JSON from the specification, or run existing tests related to security requirements.

Scritto dal modello di indicizzazione a partire dal testo della issue.