Use IPAddress.IsLoopback for robust IPv6 loopback detection and fix docs

Agent-Logs-Url: https://github.com/modelcontextprotocol/csharp-sdk/sessions/8a200407-8cc6-4c69-97e0-c9a6ad509b93

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>

Author: Copilot

src/ModelContextProtocol.Core/Authentication/ClientOAuthProvider.cs

@@ -717,8 +717,7 @@ private async Task PerformDynamicClientRegistrationAsync(
 
     private static bool IsLocalhostRedirectUri(Uri redirectUri)
         => redirectUri.Host.Equals("localhost", StringComparison.OrdinalIgnoreCase)
-        || redirectUri.Host.Equals("127.0.0.1", StringComparison.Ordinal)
-        || redirectUri.Host.Equals("::1", StringComparison.Ordinal);
+        || (System.Net.IPAddress.TryParse(redirectUri.Host, out var ipAddress) && System.Net.IPAddress.IsLoopback(ipAddress));
 
     private string? GetScopeParameter(ProtectedResourceMetadata protectedResourceMetadata)
     {

src/ModelContextProtocol.Core/Authentication/DynamicClientRegistrationRequest.cs

@@ -53,7 +53,9 @@ internal sealed class DynamicClientRegistrationRequest
     /// Gets or sets the application type for the client, as defined in OpenID Connect Dynamic Client Registration 1.0.
     /// </summary>
     /// <remarks>
-    /// Valid values are "native" and "web". MCP clients MUST specify this during Dynamic Client Registration.
+    /// Valid values are "native" and "web". Per the MCP specification, MCP clients MUST specify an appropriate
+    /// application type during Dynamic Client Registration. This field is automatically populated by the SDK
+    /// based on the redirect URI if not explicitly set via <see cref="DynamicClientRegistrationOptions.ApplicationType"/>.
     /// Native applications (desktop, mobile, CLI, localhost web apps) should use "native".
     /// Web applications (remote browser-based) should use "web".
     /// </remarks>