fix: MCP dynamic client registration omits selected OAuth scopes (#19571)

## Background

Published @ai-sdk/mcp OAuth flows could register clients without the
selected scopes, causing authorization servers to issue default-scoped
tokens that MCP resources rejected with HTTP 401.

## Root Cause

authInternal applied selectScope only when constructing the
authorization URL, while registerClient received unchanged client
metadata. The reproduction confirmed that DCR omitted the challenge or
protected-resource scopes even though authorization included them.

## Summary

Computed the selected scope once and applied it consistently to dynamic
client registration and authorization, added a patch changeset, and
removed reproduction-only artifacts.

## Testing

Added regression cases covering challenge scope precedence, protected
resource metadata scopes, and omission when no scope is discovered.

## End-to-end Validation

- `pnpm -C packages/mcp build && pnpm -C examples/ai-functions exec tsx
-e "$(git show
HEAD:examples/ai-functions/src/reproduction/mcp-dcr-scope-selection.ts)"`
— both scope-bearing flows registered and authorized with matching
scopes and returned HTTP 200; the no-scope flow omitted scope.

## Related Issues

Fixes #19496

Closes #19497

---------

Co-authored-by: ai-sdk-factory <308175966+ai-sdk-factory@users.noreply.github.com>
Co-authored-by: JHawk0224 <35184414+JHawk0224@users.noreply.github.com>
Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>