fix(auth): stop leaking oauth client secrets

[failsafesecurity]

Summary

This stops the fake OAuth dynamic registration endpoint from returning the configured upstream client_secret to arbitrary callers.

Security impact

When AuthConfig.setup_proxies=True and the default setup_fake_dynamic_registration=True are used together, POST /oauth/register is mounted and currently echoes the configured client_secret back to any caller. That lets an anonymous network client recover the server's OAuth client secret and impersonate the MCP server's upstream OAuth client.

Changes

• stop populating client_secret in the fake registration response
• force the fake registration response to behave like a public client (token_endpoint_auth_method="none")
• omit None fields from the response body
• add a regression test covering POST /oauth/register

Validation

• python3 -m compileall fastapi_mcp tests/test_auth_proxy.py
• .venv/bin/python -m pytest -q tests/test_auth_proxy.py tests/test_types_validation.py -o addopts=''

Disclosure notes

• repo: tadata-org/fastapi_mcp
• finding: unauthenticated /oauth/register client secret disclosure
• no public issue was opened