Secure credential storage for HTTP MCP OAuth tokens

### Describe the feature or problem you'd like to solve

The Copilot CLI currently persists OAuth access and refresh tokens as plaintext JSON files on disk (~/.copilot/mcp-oauth-config/*.tokens.json) when authenticating to HTTP-based MCP servers. This introduces several security concerns:
1. **Plaintext exposure** - Tokens stored as unencrypted JSON can be read by any process or user with filesystem access. This violates the principle of least privilege for credential storage.
2. **Cloud sync risk** - Many enterprise users sync their home directory or profile folders via OneDrive, Dropbox, or similar tools. Plaintext tokens in synced directories get uploaded to cloud storage, expanding the attack surface and triggering DLP/security policy violations.
3. **Credential persistence** - File-based tokens survive beyond their intended session lifetime. If a machine is compromised, an attacker gains access to cached tokens without needing to re-authenticate.
4. **Inconsistency with VS Code** - VS Code already handles MCP OAuth tokens securely through the OS Secret Storage API (Windows Credential Manager, macOS Keychain, libsecret on Linux). The CLI should follow the same pattern for consistency and security.

### Proposed solution

Leverage the OS-native credential/secret manager on each platform rather than writing tokens to disk. This aligns with security best practices, avoids DLP policy conflicts, and provides a consistent security posture across the Copilot toolchain.

### Example prompts or workflows

_No response_

### Additional context

_No response_

首先定位将 OAuth 令牌写入 ~/.copilot/mcp-oauth-config/*.tokens.json 的代码。检查 CLI 如何向基于 HTTP 的 MCP 服务器进行身份验证，以及 VS Code 如何使用 OS Secret Storage，包括 Windows Credential Manager、macOS Keychain 和 Linux 上的 libsecret。完成标准是令牌不再以明文文件形式持久化，而是通过各个平台的原生 Credential Manager 存储。

由索引模型根据 Issue 内容生成。