Update DPoP profile with server requirements from conformance implementation feedback

[PieterKas]

Implementing the SEP-1932 conformance suite (modelcontextprotocol/conformance#395, plus community extensions modelcontextprotocol/conformance#527 / modelcontextprotocol/conformance#528 / modelcontextprotocol/conformance#529) surfaced three places where the profile relied on descriptive or absent text. This PR adds the normative sentences:

• Bearer Scheme Downgrade Protection — an MCP server MUST NOT accept a DPoP-bound token presented under the Bearer scheme; rejection is HTTP 401 with a Bearer or DPoP challenge. Backs the tightened probe in feat(sep-1932): tighten the Bearer-downgrade probe (stacked on #395) conformance#527.
• Error codes — invalid_dpop_proof for RFC 9449 §4.3 validation failures (including malformed or duplicated DPoP headers), invalid_token for failures of the access token itself. Backs the §7.1 error-code check in feat(sep-1932): DPoP error codes (stacked on #527) conformance#528.
• MCP Server DPoP Advertisement (new section) — Protected Resource Metadata MUST carry dpop_signing_alg_values_supported (non-empty, asymmetric algorithms only); a server that requires DPoP-bound tokens MUST set dpop_bound_access_tokens_required: true, and a server that sets it MUST enforce it; advertising a DPoP challenge with algs is SHOULD per RFC 9449 §7.1; absent fields keep their RFC 9728 defaults. Grounds the discovery checks in feat(sep-1932): DPoP discovery signals (stacked on #528) conformance#529.
• Housekeeping — RFC 9728 added to the Standards Compliance list; the Authorization Server Metadata example trimmed to the algorithms RFC 9449 itself uses in its examples (ES256, PS256).

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[PieterKas]

@pcarleton — this adds the normative Bearer-downgrade sentence backing conformance in modelcontextprotocol/conformance#395 and modelcontextprotocol/conformance#527

Could you review/merge into the draft branch?