fix(client): treat .localhost subdomains as loopback

[rashadism]

Summary

• Treat hostnames ending in .localhost as loopback hosts for OAuth token endpoint TLS checks.
• Keep the HTTPS requirement unchanged for non-loopback HTTP token endpoints.
• Update the insecure-token-endpoint error message and add test coverage for .localhost subdomains.

Fixes #2591

Test plan

• corepack pnpm --filter @modelcontextprotocol/client test -- auth.test.ts

[changeset-bot]

🦋 Changeset detected

Latest commit: fa0cd0b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2837

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2837

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2837

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2837

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2837

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2837

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2837

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2837

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2837

commit: fa0cd0b