[PE-8858] fix: allow configured native OAuth callbacks

[yekkhan-liftoff]

Summary

• Add exact native-client callback allowlist support for fixed redirect mode.
• Keep existing localhost/loopback redirect support for Claude Code.
• Revalidate the original client redirect URI during callback handling.
• Document OAUTH_ALLOWED_CLIENT_REDIRECT_URIS.

Test

• go test ./...
• go list -m github.com/Vungle/oauth-mcp-proxy@v1.0.5-pe8858.1

Test tag

• v1.0.5-pe8858.1

Notes

• This is needed for Cursor's callback: cursor://anysphere.cursor-mcp/oauth/callback.
• Okta redirect config remains unchanged; Okta still redirects to Phoebe's /oauth/callback.