[rmcp] Notify credential stores when a refresh token is rejected

[mzeng-openai]

Summary

A provider can reject a refresh token with invalid_grant, but the credential store currently has no callback to retire that token. Later calls can load it again and repeat the failed exchange.

This adds an optional CredentialStore::on_refresh_token_rejected callback at the shared refresh boundary. It receives the credentials used for the exchange while the refresh guard is still held. The default is a no-op, so existing stores keep their behavior. Callback failures are logged without replacing TokenRefreshRejected, so callers still receive the signal to reauthorize. Other refresh failures do not invoke the callback.

Key review points:

• crates/rmcp/src/transport/auth.rs: the callback must not reacquire the refresh guard or overwrite credentials that have been replaced.

The PR targets the current upstream SDK. The original hook is also available as a 3.2.0 backport at d042aac037d97967470660b8000630b95eea3141 in mzeng-openai/rust-sdk. That backport does not include the follow-up that preserves the reauthorization signal when the callback fails.

Test Plan

• Before the callback-error follow-up, cargo test -p rmcp --lib --features auth,client,transport-streamable-http-client,reqwest transport::auth::tests:: passed all 199 tests; the original 3.2.0 backport passed all 185 tests.
• Tests cover the attempted credential snapshot, guard lifetime, callback failure, transient errors, and unchanged default behavior. The follow-up adds a regression proving that get_access_token() returns AuthorizationRequired when the rejection callback fails, with one provider request and the refresh guard released.
• git diff --check passed for the follow-up. The latest push starts a new CI run; its results are pending.

[DaleSeo]

Thanks, @mzeng-openai!