MCP discovery cache now scans for accidentally-cached secret material via a presented-credential log

Before writing an entry to the MCP OAuth discovery cache, the code now scans a log of previously-observed header, cookie, and URL values ("presented credentials") to confirm the entry wouldn't carry secret material, rather than only checking the OAuth token store as before. If that scan can't complete or exceeds its work budget, the write is refused; once the presented-credential log fills up, cache writes are refused for the rest of the process.