ClientOAuthProvider.Scopes have priority again (#1236)

[halllo]

I adjusted the priority of scope determination. Scopes specified via ClientOAuthOptions.Scopes have priority over scopes from PRM.

Motivation and Context

When the client specifies Scopes via the ClientOAuthOptions, these scopes are used before the scopes of the PRM, just as the xml comment states

"When specified, these scopes will be used instead of the scopes advertised by the protected resource.".

For example this is needed if a client only supports a subset of PRM scopes or wants to add the offline_access scope.

How Has This Been Tested?

I added test method.

Breaking Changes

No. Unless they unexpectedly rely on ClientOAuthOptions.Scopes not having an effect in the presence of PRM scopes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

This addresses #1236