Support resource indicator in remote auth

[eleftherias]

Add new --remote-auth-resource CLI flag allowing users to set the resource indicator as specified by RFC 8707 when running remote workloads.

This allows the authorization server to return a token with a scoped audience, which will then be passed to and validated by the remote MCP server.

Fix #1192

[codecov]

Codecov Report

❌ Patch coverage is 58.92857% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 55.69%. Comparing base (c17d6c5) to head (3df118b).
⚠️ Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/api/v1/workload_service.go	0.00%	12 Missing and 1 partial ⚠️
pkg/auth/oauth/flow.go	0.00%	2 Missing and 2 partials ⚠️
pkg/auth/remote/config.go	84.21%	2 Missing and 1 partial ⚠️
pkg/auth/discovery/discovery.go	50.00%	1 Missing ⚠️
pkg/auth/oauth/oidc.go	50.00%	1 Missing ⚠️
pkg/auth/remote/handler.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2497      +/-   ##
==========================================
+ Coverage   55.67%   55.69%   +0.01%     
==========================================
  Files         295      295              
  Lines       28023    28078      +55     
==========================================
+ Hits        15601    15637      +36     
- Misses      10998    11014      +16     
- Partials     1424     1427       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.