Upgrade to MCP 1.17+ with RFC 9728 compliance (#2122)

* Upgrade to MCP 1.17+ with RFC 9728 compliance

Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant
OAuth protected resource metadata URL handling.

The key change is that .well-known/oauth-protected-resource endpoints
are now registered at path-aware locations. For example, if an MCP
server is mounted at /mcp, the metadata endpoint is now at
/.well-known/oauth-protected-resource/mcp instead of
/.well-known/oauth-protected-resource.

This ensures proper OAuth discovery for path-based resource servers
and aligns with the MCP SDK's implementation of RFC 9728 §3.1.

Changes include:
- Update minimum MCP version from 1.12.4 to 1.17.0
- Use build_resource_metadata_url() for RFC 9728 compliance
- Configure CI to test with latest package versions (--upgrade)
- Update tests for path-aware metadata URLs
- Add icons field to Tool model (introduced in MCP 1.17)

* Fix RemoteAuthProvider integration tests for RFC 9728

* Fix parameterized test for nested base URL paths

tests/server/openapi/test_basic_functionality.py

@@ -100,6 +100,7 @@ class TestTools:
             meta=dict(_fastmcp=dict(tags=["create", "users"])),
             title=None,
             annotations=None,
+            icons=None,
             description=IsStr(regex=r"^Create a new user\..*$", regex_flags=re.DOTALL),
             inputSchema={
                 "type": "object",
@@ -125,6 +126,7 @@ class TestTools:
             meta=dict(_fastmcp=dict(tags=["update", "users"])),
             title=None,
             annotations=None,
+            icons=None,
             description=IsStr(
                 regex=r"^Update a user's name\..*$", regex_flags=re.DOTALL
             ),