fix: normalize OAuth redirect URI URL subtypes

[he-yufeng]

Summary

• normalize redirect_uris values at the OAuth client metadata boundary
• keep raw string, AnyUrl, and URL subtype inputs serializing the same way
• add a regression test for AnyHttpUrl registration followed by AnyUrl redirect validation

To verify

• .\.venv\Scripts\python.exe -m pytest tests\shared\test_auth.py -q
• .\.venv\Scripts\python.exe -m ruff check src\mcp\shared\auth.py tests\shared\test_auth.py
• .\.venv\Scripts\python.exe -m ruff format --check src\mcp\shared\auth.py tests\shared\test_auth.py
• git diff --check

Refs #2687

[StantonMatt]

I think this still misses one input shape Pydantic accepts for this field. redirect_uris is typed as list[AnyUrl], but Pydantic also accepts tuples/sets and coerces them to a list. Because the before validator only normalizes list, a tuple of URL subtypes still stores the element as AnyHttpUrl, so the existing comparison against an incoming AnyUrl can fail:

info = OAuthClientInformationFull(
    client_id="abc123",
    redirect_uris=(AnyHttpUrl("https://example.com/callback"),),
)
info.validate_redirect_uri(AnyUrl("https://example.com/callback"))
# InvalidRedirectUriError: Redirect URI 'https://example.com/callback' not registered for client

I verified the list cases are fixed on ffea4ae; raw-string lists, AnyHttpUrl lists, mixed lists, and single-URI default selection all behave as expected. Local checks also pass:

• uv run --frozen pytest tests/shared/test_auth.py -q
• uv run --frozen ruff check src/mcp/shared/auth.py tests/shared/test_auth.py
• uv run --frozen ruff format --check src/mcp/shared/auth.py tests/shared/test_auth.py
• uv run --frozen pyright src/mcp/shared/auth.py tests/shared/test_auth.py

Could the normalizer cover the other collection inputs Pydantic accepts here too?