Upgrade to MCP 1.17+ with RFC 9728 compliance (#2122)

* Upgrade to MCP 1.17+ with RFC 9728 compliance

Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant
OAuth protected resource metadata URL handling.

The key change is that .well-known/oauth-protected-resource endpoints
are now registered at path-aware locations. For example, if an MCP
server is mounted at /mcp, the metadata endpoint is now at
/.well-known/oauth-protected-resource/mcp instead of
/.well-known/oauth-protected-resource.

This ensures proper OAuth discovery for path-based resource servers
and aligns with the MCP SDK's implementation of RFC 9728 §3.1.

Changes include:
- Update minimum MCP version from 1.12.4 to 1.17.0
- Use build_resource_metadata_url() for RFC 9728 compliance
- Configure CI to test with latest package versions (--upgrade)
- Update tests for path-aware metadata URLs
- Add icons field to Tool model (introduced in MCP 1.17)

* Fix RemoteAuthProvider integration tests for RFC 9728

* Fix parameterized test for nested base URL paths

.github/workflows/run-tests.yml

@@ -44,8 +44,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install FastMCP
-        # run with frozen to use the current lockfile; static checks will determine if it needs updating
-        run: uv sync --frozen
+        # run with upgrade to always test against the latest compatible versions
+        run: uv sync --upgrade
 
       - name: Run tests (excluding integration and client_process)
         run: uv run pytest --inline-snapshot=disable tests -m "not integration and not client_process" --numprocesses auto --maxprocesses 4 --dist worksteal
@@ -69,8 +69,8 @@ jobs:
           python-version: "3.10"
 
       - name: Install FastMCP
-        # run with frozen to use the current lockfile; static checks will determine if it needs updating
-        run: uv sync --frozen
+        # run with upgrade to always test against the latest compatible versions
+        run: uv sync --upgrade
 
       - name: Run integration tests
         # use longer per-test timeout than the default 3s