fix: request json token responses

[he-yufeng]

Summary

• Send Accept: application/json on OAuth token exchange requests.
• Apply the same header to refresh-token requests, which use the same JSON token response parser.
• Add assertions for both request builders.

Fixes #1523.

To verify

• uv run pytest tests/client/test_auth.py -q -k "token_exchange_request_authorization_code or refresh_token_request"
• uv run ruff check src/mcp/client/auth/oauth2.py tests/client/test_auth.py
• uv run python -m py_compile src/mcp/client/auth/oauth2.py tests/client/test_auth.py

[he-yufeng]

Rebased this onto current main and re-ran the focused local checks.\n\nValidation:\n- uv run pytest tests/client/test_auth.py -q --basetemp .tmp\pytest-1523-20260530 -p no:cacheprovider (96 passed, 1 xfailed)\n- uv run ruff check src/mcp/client/auth/oauth2.py tests/client/test_auth.py\n- uv run ruff format --check src/mcp/client/auth/oauth2.py tests/client/test_auth.py\n- uv run pyright src/mcp/client/auth/oauth2.py tests/client/test_auth.py\n\nThe only early red remote job I see so far is Python 3.14 locked on windows failing during the Install uv step, before project install or tests. I will check logs once GitHub makes them available, but it does not appear to be caused by this two-file auth change.