CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...