Add OIDC authentication support to ToolHive management API server

[JAORMX]

Summary

This PR adds OIDC authentication support to the ToolHive management API server by reusing the existing authentication middleware from the pkg/auth package.

Changes

• Added OIDC flags to thv serve command: --oidc-issuer, --oidc-audience, --oidc-jwks-url, --oidc-client-id
• Integrated existing auth middleware: Reuses the same middleware architecture already used by MCP servers in thv run and thv proxy commands
• Support for both OIDC and local authentication: When OIDC is not configured, falls back to local user authentication for development
• All API endpoints protected: Authentication middleware is applied to all management API endpoints

Architecture

The implementation follows the same pattern used in other ToolHive commands:

1. OIDC Configuration: Uses auth.JWTValidatorConfig to configure JWT validation with OIDC discovery support
2. Middleware Selection: auth.GetAuthenticationMiddleware() automatically chooses between:
   • JWT validation middleware (when OIDC config is provided)
   • Local user middleware (when OIDC config is nil)
3. Consistent Security Model: Same security architecture as MCP servers

Benefits

• Enterprise-ready: Enables robust authentication for the management API
• Consistent: Uses the same middleware architecture across all ToolHive components
• Flexible: Supports both production OIDC and development local authentication
• Secure by default: All endpoints are now protected by authentication

Testing

• ✅ All existing tests pass
• ✅ Linting passes with no issues
• ✅ Build succeeds
• ✅ OIDC flags are available in thv serve --help

Usage Examples

# Local development (uses local user authentication)
thv serve --port 8080

# Production with OIDC
thv serve --port 8080 \
  --oidc-issuer https://accounts.google.com \
  --oidc-audience my-toolhive-api \
  --oidc-client-id my-client-id

This addresses the need for enterprise-ready authorization in the management API server while maintaining consistency with the existing security architecture.

[dmjb]

Rado beat me to it, but the changes look good to me.