Summary

• omit RFC 8707 resource from refresh_token requests
• normalize root protected-resource URLs so Pydantic's bare-domain trailing slash does not leak into the OAuth resource value
• keep resource on authorization and initial token exchange requests

Fixes #2578.

To verify

• python -m py_compile src\mcp\client\auth\oauth2.py tests\client\test_auth.py
• uv run pytest tests\client\test_auth.py -q --basetemp .tmp\pytest -p no:cacheprovider
• uv run ruff check src\mcp\client\auth\oauth2.py tests\client\test_auth.py
• uv run ruff format --check src\mcp\client\auth\oauth2.py tests\client\test_auth.py
• uv run pyright src\mcp\client\auth\oauth2.py tests\client\test_auth.py
• git diff --check