Wire up the three new auth conformance scenarios from

[AkbarDizaji]

Is your feature request related to a problem? Please describe.
The SDK's conformance coverage now lags the conformance package.
@modelcontextprotocol/conformance 0.2.0-alpha.10 (published
2026-07-27) adds exactly three scenarios relative to the pinned
alpha.9 — a full scenario-list diff of the two CLIs shows 108 → 111,
all in the auth extension: auth/dpop, auth/dpop-nonce, and
auth/wif-jwt-bearer. No test in ClientConformanceTests.cs
references any of them, so client auth behavior in these areas
currently ships unverified against the conformance suite — just as
auth becomes the declared post-2.0 focus area (roadmap, area-auth).

Describe the solution you'd like
Bump the pin to 0.2.0-alpha.10 and wire the three scenarios into
ClientConformanceTests — new InlineData entries plus, I expect,
supporting work in ConformanceClient / TestOAuthServer. Given
#1763 just added JWT-bearer identity-assertion grant support to
ClientOAuthProvider, auth/wif-jwt-bearer looks like the natural
starting point. If this isn't already planned in-house, I'd like to
take it, issue-first per CONTRIBUTING — this issue is that first step.

Describe alternatives you've considered

• A plain version bump without test wiring: verified to change no test
  outcomes, since nothing references the new scenarios — not worth a PR
  on its own.
• Waiting for the maintainers' in-flight auth work to cover it: fine
  if that's the plan; asking here to avoid duplicating it.
• Grouping this under the Track B structure proposed in Conformance Track B: stateful HTTP/stdio modes, SEP-2549 absence-assert, remaining MRTR scenarios #1653 instead
  of a standalone change — happy to align with whichever grouping is
  preferred.

Additional context
Before filing, I checked whether the currently gated SEP-2575 /
SEP-2243 scenarios are also blocked on the bump: they are not. Both
are already present in alpha.9's bundle and CLI listing (which is what
NodeHelpers.HasInstalledConformanceScenario inspects), and they run
in CI today under the existing pin. So this issue concerns only the
three genuinely new auth scenarios.