AI MCP OAuth2

Fixed an issue where MCP-like request was not authenticated.

Fixed an issue where the oidc schema was polluted during merging.

Fixed an issue where resource without path was not correctly handled.

Fixed an issue where there was an unexpected required: false in the plugin schema.

Fixed an issue where x-forwarded-* headers were not respected.

Fixed an issue where MCP-like request was not authenticated. Previously, we only authenticated requests that satisfied the MCP spec. As a result, the attacker can bypass this via an MCP-like request. Therefore, now we change to authenticate all the requests.

Fixed an issue where the oidc schema was polluted during merging.

Fixed an issue where resource without path was not correctly handled.

Fixed an issue where x-forwarded-* headers were not respected.

Introduced the AI MCP OAuth2 plugin, which protects the MCP traffic with OAuth2.

Dropped the enabled field, as we already have one in plugin table.