[Client] Implement Cross-App Access (token exchange, RFC 8693)

Context

Cross-App Access (XAA) lets an MCP client present an existing IdP id_token to the MCP server's authorization server to obtain a scoped access token for the MCP resource. Uses grant_type=urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693).

Scope

• Mcp\Client\Auth\Grant\TokenExchangeGrant:
  • Body params: grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token=<idp_id_token>, subject_token_type=urn:ietf:params:oauth:token-type:id_token, audience=<mcp_resource>, optional scope.
  • Authenticate to token endpoint per #321.
• Builder API to supply IdP id_token + IdP issuer/token_endpoint discovery (needed by the conformance harness; see #325).

Conformance scenarios unblocked

auth/cross-app-access-complete-flow.

Dependencies

Blocked by: #321, #318.

Acceptance

• Unit tests for token exchange request shape.
• Conformance: scenario passes.

cc @soyuka

Inizia con Mcp\Client\Auth\Grant\TokenExchangeGrant e rivedi le dipendenze #321 e #318 per l’autenticazione del token-endpoint e i requisiti del builder. Usa i parametri della request indicati come struttura di destinazione, aggiungi la copertura dei test unitari per tale struttura ed esegui lo scenario di conformità auth/cross-app-access-complete-flow; il lavoro è completato quando lo scenario ha esito positivo.