OAuth discovery rejects metadata without `issuer`, breaking compatibility with rmcp 2.2

[tsarlandie-oai]

Description

rmcp 3.0.0-beta.1 rejects OAuth authorization-server metadata that omits issuer, although the same metadata works with rmcp 2.2.0.

For example:

{
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token"
}

When returned from an OAuth authorization-server metadata endpoint, this document causes AuthorizationManager::discover_metadata() to fail with AuthorizationServerMissingIssuer.

This appears to be an unintended regression introduced by #996. Its description explicitly states that issuer validation should reject mismatches while “preserving compatibility for metadata that omits issuer,” but the current implementation rejects missing issuers unconditionally.

Although omitting issuer is not compliant with modern OAuth metadata requirements, existing MCP servers use this shape and are supported by the current stable release.

Expected behavior: Metadata with an explicitly provided but incorrect issuer should be rejected, while legacy metadata omitting issuer should continue to work as it does in rmcp 2.2.0.

Actual behavior: Both incorrect and missing issuers are rejected.

Versions:

• rmcp 2.2.0: accepted.
• rmcp 3.0.0-beta.1: rejected.