[Client][Server] Ship extension classes for the two authorization extensions #721

Currently neither side announces the authorization extensions from #669. The extension guides ask for that, the normative specs in modelcontextprotocol/ext-auth don't:

• client: io.modelcontextprotocol/oauth-client-credentials and io.modelcontextprotocol/enterprise-managed-authorization in clientCapabilities.extensions ("must" in the guides)
• server: io.modelcontextprotocol/oauth-client-credentials in the server/discover capabilities (optional, "recommended for discoverability")

Nothing breaks without it - conformance doesn't check it, and the TypeScript and Python SDKs don't announce them either. Users can already do it with their own AbstractExtension, but since the prefix is reserved for official extensions, it's on us to ship the classes, like McpApps:

$client = Client::builder()
    ->enableExtension(new OAuthClientCredentials())
    ->build();

$server = Server::builder()
    ->enableExtension(new OAuthClientCredentials())
    ->build();

OAuth::forServiceAccount() can't enable it on its own, since core must not know concrete extensions - so it stays opt-in and gets documented next to forServiceAccount() and setCrossAppAccess(). Low priority, rather a follow up once the other SDKs move.