Add conformance tests for authorization baseline

Similar to https://github.com/modelcontextprotocol/conformance/issues/78 but even simpler, there are a number of baseline expectations that we could check without even needing a mock AS in the mix. A protected server (remote server requiring authorization) MUST always:

• Reject requests with a malformed Authorization header, e.g. Authorization: foo (https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#token-requirements)
• Reject requests with a well-formed Authorization header but a garbage access token, e.g. Authorization: Bearer foo (https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#token-handling)

And some smoke tests for poor JWT implementations - not all access tokens are JWTs, but they are common enough that these footguns are well-documented:

• Reject requests containing an unsigned JWT (no signature part)
• Reject requests containing a JWT with alg: "none" (an old trick to get around signature validation, should be rejected by all modern JWT libs)
• Reject requests containing a self-signed JWT (the presence of a signature is not enough, it must be signed with a trusted key!)

Start by reviewing the related issue at https://github.com/modelcontextprotocol/conformance/issues/78 and the authorization requirements linked in this issue, then locate the existing conformance test entry points. Done means protected servers reject malformed and invalid bearer tokens, unsigned or alg:none JWTs, and self-signed JWTs.