Function discoverAuthorizationRequirements

Walk the OAuth discovery chain starting from an agent URL. Returns an AuthorizationRequirements diagnostic record for a Bearer challenge (even when later metadata is absent), or null when the probe is not a Bearer 401. Use hasValidatedMcpAuthorizationRequirements before promoting the record to an interactive OAuth requirement.

Strategy:

1. POST tools/list to the agent with no Authorization header.
2. If 401 + WWW-Authenticate: Bearer: parse the challenge.
3. Resolve resource_metadata=…, or the RFC 9728 well-known fallback, then GET it and read resource + authorization_servers.
4. For the first authorization_servers[0]: GET /.well-known/oauth-authorization-server and read authorization_endpoint, token_endpoint, registration_endpoint, scopes_supported.
5. Return a structured record.

Anything missing from the chain surfaces as undefined on the result — callers can still present a partial picture without re-probing.