feat(auth): support OAuth 2.0 client_credentials grant type

[MukundaKatta]

Closes #1225

Why

MCP servers fronted by an API gateway with M2M credentials currently require users to manually obtain a Bearer token outside the inspector and paste it into a custom header. The issue asks for native client_credentials support so the inspector can do this exchange itself.

What

• New client/src/lib/clientCredentialsAuth.ts exporting:
  • buildClientCredentialsRequest() - pure builder for the RFC 6749 section 4.4 token request (HTTP Basic by default, body fallback, optional scope, optional RFC 8707 resource).
  • exchangeClientCredentials() - performs the POST against the token endpoint, surfaces OAuth error/error_description on failure, returns parsed OAuthTokens.
• Refactored AuthDebugger to expose two tabs: Authorization Code (existing, unchanged behaviour) and Client Credentials (new). The new tab renders fields for token endpoint, client ID, client secret, optional scope, and a select for Basic vs body client authentication.
• Tokens obtained via the new flow are saved through the existing DebugInspectorOAuthClientProvider, so the rest of the connection / proxy stack picks them up unchanged. The proxy fetchFn is reused too, so the request goes through the inspector proxy when one is configured (avoids browser CORS on the auth server's token endpoint).

Tested

• New unit tests in client/src/lib/__tests__/clientCredentialsAuth.test.ts:
  • default Basic auth + body shape
  • scope trimming / omission
  • body-mode credentials
  • URL-encoded special chars in basic credentials
  • successful token round-trip with a mocked fetch
  • error payload surfacing (invalid_client: secret rejected)
  • non-JSON error fallback to status line
• Existing AuthDebugger tests remain valid: the default tab is authorization_code, so all previously-asserted buttons (Guided OAuth Flow, Quick OAuth Flow, Clear OAuth State, Continue from OAuthFlowProgress) are still rendered.

Manual verification (suggested for reviewers): point the inspector at any MCP server behind an OAuth 2.0 client_credentials gateway (Auth0 M2M, Okta service apps, Keycloak service accounts, etc.), open Authentication Settings -> Client Credentials, fill in token endpoint / client id / secret / optional scope, click "Request Token", confirm the access token is fetched and used by subsequent requests without any header copy/paste.