Feat: Add Descope as an MCP authentication provider

[joshwertheim]

Add Descope as an MCP authentication provider

Description

Update Agentgateway with a new Descope provider similarly to the Okta, Keycloak, and Auth0 providers.

Changes

1. Authorization Server Metadata (mcp/auth.rs): Routes Descope to the OIDC Discovery endpoint (/.well-known/openid-configuration) rather than RFC 8414's path-based format like Keycloak/Okta. Rewrites the registration_endpoint in the AS metadata to proxy DCR through agentgateway (same CORS workaround as other providers).
2. DCR (Dynamic Client Registration) (mcp/auth.rs): Derives the Descope DCR URL from its agentic issuer format: https://api.descope.com/v1/apps/agentic/{project-id}/{server-id} -> https://api.descope.com/v1/mgmt/mcp/client/{project-id}/{server-id}/register. Will return a clear error if the issuer URL doesn't match the expected agentic format.
3. JWKS URL (types/agent.rs): Descope's JWKS lives at the project level, not the issuer level. For agentic issuers the JWKS URL is derived as https://api.descope.com/{project-id}/.well-known/jwks.json
4. Proto: resource.proto is modified to add DESCOPE = 4 to the McpIDP enum, and api/resource.pb.go is the regenerated Go protobuf output reflecting that change.
5. Config/Schema/Docs: McpIDP::Descope {} added as a new enum variant, schema/config.json and schema/config.md updated to expose descope: {} as a valid provider option, examples/mcp-authentication/config.yaml gets a fully commented-out Descope example block, including a note that setting up a client in the Descope Console and using its clientId is recommended over DCR because DCR requires a management key.

[joshwertheim]

Apologies @howardjohn but if you could take one more look for the workflows that would be great.

[joshwertheim]

@howardjohn sorry there was a conflict, so I pushed one more rebase to handle it...

[howardjohn]

🤞