GitHub namespace permissions are case-sensitive but GitHub usernames/orgs are case-insensitive

Describe the bug
When authenticating via GitHub OIDC, the registry creates permission patterns using the exact casing from the repository_owner claim (e.g., io.github.PrefectHQ/*). When attempting to publish a server with a lowercase namespace (e.g., io.github.prefecthq/prefect-mcp-server), the publish fails with a 403 error because the permission check at internal/auth/jwt.go:163 uses case-sensitive string matching.

Since GitHub usernames and organization names are case-insensitive, this creates an inconsistency where the registry treats them as case-sensitive.

To Reproduce

1. Authenticate via GitHub OIDC from a repository owned by an organization with capital letters (e.g., PrefectHQ)
2. Create a server.json with a lowercase namespace: io.github.prefecthq/my-server
3. Attempt to publish using mcp-publisher publish
4. Receive 403 error: "You have permission to publish: io.github.PrefectHQ/*. Attempting to publish: io.github.prefecthq/my-server"

Expected behavior
Since GitHub usernames/orgs are case-insensitive, the registry should either:

• Normalize GitHub namespaces to lowercase when creating permissions
• Use case-insensitive matching for io.github.* namespaces
• Accept the server name with either casing

Logs

Publishing to https://registry.modelcontextprotocol.io...
Error: publish failed: server returned status 403: {"title":"Forbidden","status":403,"detail":"You do not have permission to publish this server. You have permission to publish: io.github.PrefectHQ/*. Attempting to publish: io.github.prefecthq/prefect-mcp-server"}

Additional context
The issue occurs in the isResourceMatch function at internal/auth/jwt.go:163 which uses case-sensitive strings.HasPrefix. The permission is created at internal/api/handlers/v0/auth/github_oidc.go:292 using the exact repository_owner value from the OIDC token.