fix(mcp): reject private OAuth endpoints before sending credentials (#19500)

## Background

When an MCP server does OAuth, it sends back metadata that includes a
`token_endpoint` URL. The client trusted that URL and POSTed secrets to
it. the check on the URL wasn't a strong one and a malicious server
could point `token_endpoint` there, steal those secrets and replay them
for the user’s tokens.

## Summary

the client now checks the endpoint:

- only http / https
- no private / link-local IPs
- localhost still allowed

## End-to-End Verification

na

## Checklist

- [x] All commits are signed (PRs with unsigned commits cannot be
merged)
- [x] Tests have been added / updated (for bug fixes / features)
- [ ] Documentation has been added / updated (for bug fixes / features)
- [x] A _patch_ changeset for relevant packages has been added (for bug
fixes / features - run `pnpm changeset` in the project root)
- [x] I have reviewed this pull request (self-review)