fix: remove inaccurate required markers from OAuth Issuer URL and Token URL

[marekdano]

Closes IBM/mcp-context-forge#6467

Summary

• Removes the required-field asterisk (and sr-only "(required)" text) from the Issuer URL and Token URL labels in the OAuth 2.0 section of the MCP server form.
• Neither field is actually required: they're alternatives — supplying an issuer lets discovery derive the token URL, or the token URL can be supplied directly with no issuer. Marking both mandatory pushed every user down the manual-entry path and contradicted the Issuer URL helper text, which already says the field exists for endpoint discovery.
• Confirmed neither field is enforced anywhere: oauthConfigSchema in useMCPServerForm.ts already declares issuer/token_url as .optional() with no cross-field refinement requiring either, and the backend's _validate_oauth_config_urls (mcp-context-forge schemas.py) only checks URL format, never presence. So this is a visual-only fix — no submission-blocking behavior changes.
• Added a regression test asserting Issuer URL and Token URL no longer show a required indicator, while Grant type (which is genuinely required) still does.

Out of scope (tracked separately): leave-blank/auto-fill guidance for these fields is covered by IBM/mcp-context-forge#6460, which explicitly depends on this fix landing first.

Test plan

• vitest run src/components/mcp-servers/OAuth2Auth.test.tsx — 16/16 passing, including new regression test
• vitest run on OAuth2Auth/AdvancedSettings/MCPServerForm/useMCPServerForm suites — 200/200 passing
• eslint clean on changed files
• tsc --noEmit clean

[vishu-bh]

Solid 🚀

[a-effort]

Reviewed the diff. No blockers.

The required asterisk and sr-only (required) span are removed from the Issuer URL and Token URL labels. The label element's className is simplified from inline-flex with gap to plain text-sm since it no longer needs to lay out an asterisk alongside the text. The Grant type label is unchanged and still carries the required indicator.

The test queries the DOM directly for label[for='oauth-issuer-url'] and label[for='oauth-token-url'], then asserts the absence of * and (required) in their text content. This is a reasonable regression test. One note: toHaveTextContent does a substring match by default, so the assertion that the label does not contain * would also catch any label text that happens to include a literal asterisk for other reasons. That's not a concern here but worth knowing if these assertions are reused elsewhere.