Fixes #2216

Summary

Updates OAuthClientMetadata.validate_scope() so a registered client with scope=None does not reject requested authorization scopes.

When the registration response omits scope, the SDK treats that as no client-specific scope restriction instead of converting it to an empty allowed-scope list. Explicit registered scopes are still enforced.

Tests

.\.venv\Scripts\python.exe -m pytest tests/shared/test_auth.py -q
.\.venv\Scripts\python.exe -m ruff check src/mcp/shared/auth.py tests/shared/test_auth.py
.\.venv\Scripts\python.exe -m ruff format --check src/mcp/shared/auth.py tests/shared/test_auth.py
git diff --check

Notes

Added regression coverage for:

• no requested scope returns None
• registered scopes are accepted
• unregistered scopes are still rejected
• omitted registered scope allows requested scopes