Forward-port Hugging Face auth provider

[jlowin]

The 3.4.4 release added first-class Hugging Face OAuth support on the maintenance branch. Main should carry the same provider so SDK-v2 work does not leave the new auth integration behind.

This adds a Hugging Face OAuthProxy provider for public PKCE apps, confidential apps, and CIMD flows. Opaque access tokens are verified through Hugging Face userinfo/whoami endpoints, while scopes from the upstream token response remain the source of truth for FastMCP-issued tokens.

from fastmcp import FastMCP
from fastmcp.server.auth.providers.huggingface import HuggingFaceProvider

auth = HuggingFaceProvider(
    client_id="hf-client-id",
    client_secret="hf-client-secret",
    base_url="https://mcp.example.com",
)

mcp = FastMCP("Hugging Face MCP", auth=auth)