GHSA-8cp3-qxj6-px34: utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion

The utcp-http library (<= 1.1.3) unconditionally trusts the tokenUrl field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim’s client_id and client_secret to the attacker-supplied token endpoint without any URL validation. The same ensure_secure_url() guard applied to discovery URLs and tool invocation URLs is absent for the OAuth2 token endpoint, creating a credential-exfiltration path.