[auth] refactor resource selection to not include resource if PRM is not present

[pcarleton]

Motivation and Context

See modelcontextprotocol/inspector#551
see also modelcontextprotocol/python-sdk#991 (comment)

When an MCP server only supports the old specification, we shouldn't include the resource parameter. Ultimately, it's the server's responsibility to enforce resource parameter usage, so if an impersonation attack happens, the server will still be protected by rejecting tokens that don't have a matching included resource, and the server can choose to include PRM to get the resource parameter passed to fix it.

How Has This Been Tested?

Added unit tests

Breaking Changes

No, this will unbreak some servers that would reject an authorization URL with resource in the parameters (e.g. Entra).

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[ihrpr]

LGTM!