Add CIMD support to MCP OAuth registration (#38089)

## What changed

- Make automatic MCP OAuth registration prefer Client ID Metadata Documents
  (CIMD) when the authorization server advertises support for public clients and
  Codex is using its native loopback callback. Fall back to advertised Dynamic
  Client Registration (DCR) otherwise.
- Add explicit `cimd` and `dcr` registration overrides to the CLI and app-server
  OAuth login API. Validate CIMD metadata and callback URLs before starting the
  authorization flow.
- Use a callback-specific Codex client metadata URL for CIMD and retain the
  exact redirect URI through authorization and token exchange.

## Testing

- Cover automatic and forced CIMD selection, DCR fallback, invalid metadata and
  redirects, token refresh, authenticated MCP requests, and conformance
  regression checks.

GitOrigin-RevId: 4238372ca53b0f38e781e141ab5da97e0a6ddf45

codex-rs/app-server-protocol/src/protocol/v2/mcp.rs

@@ -196,7 +196,7 @@ pub struct McpServerOauthLoginParams {
     pub name: String,
     #[ts(optional = nullable)]
     pub thread_id: Option<String>,
-    /// Registration strategy for this login only; omission preserves automatic DCR.
+    /// Registration strategy for this login only; omission selects automatic discovery.
     #[ts(optional = nullable)]
     pub client_registration: Option<McpServerOauthClientRegistration>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -213,6 +213,7 @@ pub struct McpServerOauthLoginParams {
 pub enum McpServerOauthClientRegistration {
     #[default]
     Auto,
+    Cimd,
     Dcr,
 }