d84ece48b8
Figma's authorization-server metadata advertises authorization_response_iss_parameter_supported and its redirect omits iss, so the mcp SDK's RFC 9207 check discarded every valid code and login never finished. For that one issuer the provider fills a missing iss with the discovered issuer and warns; a mismatching iss still fails and every other server keeps the strict rule. Fixes #111135