fix: consistently use consumer-provided fetch function

[LucaButBoring]

Updates the transports and auth to consistently use the consumer-provided fetch function, if provided.

Motivation and Context

Enables usage in environments with non-conformant fetch globals, and assists in debugging. I was passing a custom fetch function to check the request order in the auth flow, and wasn't seeing everything due to this issue.

How Has This Been Tested?

Existing unit tests plus a spot check in my debug setup.

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• I left the ?? fetch fallbacks in the code to avoid needing to change the unit tests. The unit tests currently rely on the fact that the global fetch is always looked up at call-time due to mocking the global fetch function.

[ihrpr]

Thank you so much for fixing it!

Please can you add unit tests that verify custom fetch functions are actually called throughout the auth flow

[LucaButBoring]

Added partial unit tests, not ready for re-review yet (will request review once this is more comprehensive)

[LucaButBoring]

Found one missing usage with exchangeAuthorization that has now been fixed - took a while to come up with an appropriate way to test the transports, but this should be ready, now.

[ihrpr]

Thank you!