fix(auth): normalize explicit default ports in resource_url_from_server_url (RFC 3986)

[teddiesloco]

Summary

Fixes #3297.

resource_url_from_server_url() lowercases the scheme/authority and strips URL fragments, but previously preserved explicitly specified default ports (:80 for HTTP, :443 for HTTPS).

Per RFC 3986 §6.2.3 (Scheme-Based Normalization), an explicit default port is equivalent to an omitted port. Furthermore, Pydantic's HttpUrl automatically normalizes metadata URLs by dropping default ports. Because resource_url_from_server_url() preserved them, check_resource_allowed() would reject an otherwise identical resource (e.g. comparing https://example.com:443/mcp against https://example.com/mcp), leading to false-positive authorization failures.

Changes

1. _canonical_netloc() Helper: Normalizes netloc by stripping default port 80 for http and 443 for https, while preserving non-default ports, userinfo, and IPv6 literals.
2. check_resource_allowed(): Canonicalizes both requested_resource and configured_resource before parsing to guarantee consistent comparison across equivalent URL representations.
3. Tests:
   • Added unit tests verifying default ports 80 and 443 are stripped from canonical resource URLs while non-default ports like 8443 or 8080 are preserved.
   • Added tests verifying check_resource_allowed() correctly evaluates matching resources regardless of explicit default port notation in either parameter.

Verification

• Ran uv run pytest tests/shared/test_auth_utils.py tests/client/test_auth.py: 155 passed, 1 xfailed (pre-existing).

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because you aren't currently assigned to #3297.

If a maintainer would like this change as a PR from you, they'll assign you to #3297 and this PR will reopen automatically — there's nothing more you need to do. (If you opened the issue, this PR already shows up on its timeline.)

There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten.

Maintainers: reopening this PR, removing the missing-issue-link label, or adding bypass-issue-check bypasses the check.