feat(http): add --authorization-server flag to override OAuth AS URL

[Anika-Sol]

Summary

Adds a --authorization-server CLI flag (and GITHUB_AUTHORIZATION_SERVER env var) to the http subcommand, allowing operators to override the authorization server URL advertised in the OAuth Protected Resource Metadata (/.well-known/oauth-protected-resource).

Why

When deploying the MCP server against GitHub Enterprise Server, GHES does not natively support RFC 8414, RFC 7591, or PKCE — making direct MCP OAuth impossible. A common solution is to deploy a thin OAuth proxy in front of GHES that implements the MCP OAuth spec. However, the MCP server always derives authorization_servers from GITHUB_HOST, so clients are pointed at GHES directly instead of the proxy. Without this flag, operators must intercept /.well-known/oauth-protected-resource at the ingress layer as a workaround.

The AuthorizationServer field already exists in pkg/http/oauth/oauth.Config with the conditional in place — it simply wasn't reachable from any configuration surface.

What changed

• Added AuthorizationServer string field to pkg/http/server.go ServerConfig
• Wired cfg.AuthorizationServer into the oauth.Config struct in RunHTTPServer
• Added --authorization-server flag on httpCmd in cmd/github-mcp-server/main.go
• Added viper binding so GITHUB_AUTHORIZATION_SERVER env var works automatically

MCP impact

• No tool or API changes — only affects OAuth metadata discovery; no tools, schemas, or API behavior changed

Prompts tested (tool changes only)

• N/A

Security / limits

• Auth / permissions considered — when set, this flag redirects clients to a different authorization server. Operators are responsible for ensuring the configured URL points to a trusted proxy. No change to token validation or API access control.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)