[PE-8844] feat: add MCP service-token auth

[yekkhan-liftoff]

Summary

• add optional asymmetric service-token validation to oauth-mcp-proxy
• route configured service-token issuer JWTs to public-key validation while preserving existing OAuth/OIDC validation for all other tokens
• document service-token config, token contract, key handling, and env vars

Tests

• go test ./... -count=1