Fix Azure scope fallback

[zzstoatzz]

Azure-backed servers currently authorize successfully when an MCP client omits scope, because the authorize URL falls back to the provider's configured required_scopes. The token exchange path did not make the same fallback, so Entra could receive a token request whose scope was only offline_access, which it rejects with AADSTS70011.

This keeps the existing authorize behavior and applies the same fallback when preparing Azure token-exchange and refresh scopes. Scope-sending clients keep their requested scopes; scope-omitting clients now exchange and refresh against the configured API scope instead of offline_access alone.

provider = AzureProvider(
    client_id="...",
    client_secret="...",
    tenant_id="...",
    required_scopes=["mcp.access"],
    base_url="https://example.com/mcp",
)

provider._prepare_scopes_for_token_exchange([])
# ["api://.../mcp.access", "offline_access"]

Fixes #4467

🤖 Generated with Codex