Support pre-registered public OAuth clients for HTTP MCP connectors

## Issue Description

Azure SRE Agent's generic Streamable HTTP OAuth connector requires dynamic client registration. This prevents connecting to MCP servers that publish a fixed public client, including Work IQ.

Work IQ publishes:
- Endpoint: https://workiq.svc.cloud.microsoft/mcp
- Public client ID: ba081686-5d24-4bc6-a0d6-d034ecffed87
- Authorization Code + PKCE

Azure SRE currently times out while waiting for DCR, which Microsoft Entra does not support.

## Steps to Reproduce

1. Add a custom Streamable HTTP MCP connector.
2. Use https://workiq.svc.cloud.microsoft/mcp.
3. Select OAuth authentication.
4. Attempt authorization.
5. Observe timeout waiting for the authorization URL because the flow expects dynamic client registration.

## Expected Behavior

Allow pre-registered OAuth configuration with a fixed client ID, public-client PKCE flow, callback configuration, secure token caching, automatic refresh, and reauthentication after revocation or Conditional Access.

One interactive sign-in should keep the connector available across access-token expiry and agent restarts without copying bearer tokens.

## Actual Behavior

The connector supports only dynamic client registration. Authorization cannot start for Work IQ's published fixed public client, so users must manually paste short-lived bearer tokens to expose tools such as create_entity and fetch.

Start with the generic Streamable HTTP OAuth connector and reproduce the timeout using the Work IQ endpoint and its published client ID. Trace the dynamic client registration step and compare it with the expected public-client Authorization Code + PKCE flow. Done means one sign-in supports token caching, refresh, restarts, and reauthentication after revocation or Conditional Access without bearer-token copying.

Written by the indexing model from the issue text.