The MCP Go SDK's OAuth discovery client refuses HTTP downgrades and private-IP redirects.

PR #1220, merged September 2, adds four checks to the default OAuth discovery client: no redirects downgrading to plain HTTP, no redirects to localhost or private IP ranges, no initial call to a private IP, and an explicit-proxy opt-out from dial-time checking. SSRF hardening on the discovery leg, where a malicious server-supplied metadata URL could previously walk a client onto an internal address.