[auth] Adjust scope management to line up with SEP-835

[pcarleton]

Motivation and Context

When writing the conformance test: modelcontextprotocol/conformance#36, I discovered 2 issues with our scope management:

• We don't set the auth header in the requireBearer middleware
• We don't use scopes_supported from the PRM in the scope passing

How Has This Been Tested?

Added conformance tests

Breaking Changes

This lines us up with the specification

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context