refactor: replace MicrosoftOidcMetadataPolicy with built-in LenientOidcDiscoveryMetadataPolicy

- Microsoft example now uses LenientOidcDiscoveryMetadataPolicy directly
- Remove MicrosoftOidcMetadataPolicy and its test (functionally identical)

Author: simonchrz

examples/server/oauth-microsoft/MicrosoftOidcMetadataPolicy.php

@@ -150,7 +150,7 @@ curl -X POST http://localhost:8000/mcp \
 - `env.example` - Environment variables template
 - `server.php` - MCP server with OAuth middleware
 - `MicrosoftJwtTokenValidator.php` - Example-specific validator for Graph/non-Graph tokens
-- `MicrosoftOidcMetadataPolicy.php` - Lenient metadata validation policy
+- Uses built-in `LenientOidcDiscoveryMetadataPolicy` for metadata validation
 - `McpElements.php` - MCP tools including Graph API integration
 
 ## Environment Variables
@@ -200,9 +200,8 @@ Microsoft's JWKS endpoint is public. Ensure your container can reach:
 
 The default `StrictOidcDiscoveryMetadataPolicy` requires `code_challenge_methods_supported`.
 Microsoft Entra ID omits this field despite supporting PKCE with S256.
-Use the built-in `LenientOidcDiscoveryMetadataPolicy` which accepts missing `code_challenge_methods_supported`
-(defaults to S256 downstream). The `MicrosoftOidcMetadataPolicy` in this example demonstrates
-how to implement a custom policy via `OidcDiscoveryMetadataPolicyInterface`.
+This example uses the built-in `LenientOidcDiscoveryMetadataPolicy` which accepts missing
+`code_challenge_methods_supported` (defaults to S256 downstream).
 
 ### Graph API errors
 

examples/server/oauth-microsoft/README.md

@@ -16,7 +16,6 @@
 use Http\Discovery\Psr17Factory;
 use Laminas\HttpHandlerRunner\Emitter\SapiEmitter;
 use Mcp\Example\Server\OAuthMicrosoft\MicrosoftJwtTokenValidator;
-use Mcp\Example\Server\OAuthMicrosoft\MicrosoftOidcMetadataPolicy;
 use Mcp\Server;
 use Mcp\Server\Session\FileSessionStore;
 use Mcp\Server\Transport\Http\Middleware\AuthorizationMiddleware;
@@ -25,6 +24,7 @@
 use Mcp\Server\Transport\Http\Middleware\ProtectedResourceMetadataMiddleware;
 use Mcp\Server\Transport\Http\OAuth\JwksProvider;
 use Mcp\Server\Transport\Http\OAuth\JwtTokenValidator;
+use Mcp\Server\Transport\Http\OAuth\LenientOidcDiscoveryMetadataPolicy;
 use Mcp\Server\Transport\Http\OAuth\OidcDiscovery;
 use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
 use Mcp\Server\Transport\StreamableHttpTransport;
@@ -37,7 +37,7 @@
 $localBaseUrl = 'http://localhost:8000';
 
 $discovery = new OidcDiscovery(
-    metadataPolicy: new MicrosoftOidcMetadataPolicy(),
+    metadataPolicy: new LenientOidcDiscoveryMetadataPolicy(),
 );
 
 $jwtTokenValidator = new JwtTokenValidator(