[Client] Implement Cross-App Access (token exchange, RFC 8693)

Context

Cross-App Access (XAA) lets an MCP client present an existing IdP id_token to the MCP server's authorization server to obtain a scoped access token for the MCP resource. Uses grant_type=urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693).

Scope

• Mcp\Client\Auth\Grant\TokenExchangeGrant:
  • Body params: grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token=<idp_id_token>, subject_token_type=urn:ietf:params:oauth:token-type:id_token, audience=<mcp_resource>, optional scope.
  • Authenticate to token endpoint per #321.
• Builder API to supply IdP id_token + IdP issuer/token_endpoint discovery (needed by the conformance harness; see #325).

Conformance scenarios unblocked

auth/cross-app-access-complete-flow.

Dependencies

Blocked by: #321, #318.

Acceptance

• Unit tests for token exchange request shape.
• Conformance: scenario passes.

cc @soyuka

Comienza con Mcp\Client\Auth\Grant\TokenExchangeGrant y revisa las dependencias #321 y #318 para la autenticación del token-endpoint y los requisitos del builder. Usa los parámetros de request indicados como estructura objetivo, añade cobertura de unit tests para esa estructura y ejecuta el escenario de conformidad auth/cross-app-access-complete-flow; se considera terminado cuando el escenario pasa.