Document scope policy as the provider's responsibility in authorize()

Spell out on OAuthAuthorizationServerProvider.authorize() that the
requested scopes have only been checked against the server-wide
valid_scopes and that per-client scope policy is enforced here, so the
contract lives on the interface operators implement rather than only
in the migration guide.

No-Verification-Needed: docstring-only change

Author: maxisbey

src/mcp/server/auth/provider.py

@@ -192,6 +192,12 @@ async def authorize(self, client: OAuthClientInformationFull, params: Authorizat
         and MUST generate an authorization code with at least 128 bits of entropy.
         See https://datatracker.ietf.org/doc/html/rfc6749#section-10.10.
 
+        Scope policy is this method's responsibility. `params.scopes` has been checked only
+        against the server-wide `ClientRegistrationOptions.valid_scopes` (when configured); the
+        client's registered `scope` metadata is self-asserted (RFC 7591 §2) and is not enforced.
+        Reject a request the client may not make by raising `AuthorizeError` with
+        `error="invalid_scope"`, or grant a narrower scope set - and issue the token accordingly.
+
         Args:
             client: The client requesting authorization.
             params: The parameters of the authorization request.