fix(oauth): do not treat empty secret as valid for public clients

[mathetake]

This fixes the oauth's client registration portion where we should treat empty client secret as invalid. The rationale is pretty much written in the code comment.

Motivation and Context

This will expand the support for more auth servers.

How Has This Been Tested?

This makes Goose work with some public IdP providers such as https://app.descope.com

Breaking Changes

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

The following is the example client registration response to the request made by Goose where the client_secret field is present vs its value is empty string.

{
  "audienceWhitelist": [],
  "client_id": "aaaaaaaaaaaaaaaaaaaa=",
  "client_id_issued_at": 1758140791,
  "client_name": "MCP Client",
  "client_secret": "",
  "client_secret_expires_at": 0,
  "description": "",
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "jwt_bearer_settings": null,
  "login_page_url": "https://api.descope.com/login/aaaaaaaaaaaaaaaaaaaa?flow=inbound-apps-user-consent",
  "redirect_uris": [
    "http://localhost:54641/oauth_callback"
  ],
  "response_types": [
    "code"
  ],
  "scope": "",
  "session_settings": null,
  "token_endpoint_auth_method": "none"
}