[Matthew Henderson (mattchenderson)]

This PR establishes explicit metadata for UserEntraToken and AgentOnBehalfOfUser authentication and removes OAuth2-only metadata that caused ordinary partner servers to expose Microsoft identity options they do not support. Existing OAuth, connector-backed OAuth, bearer, and key-based paths remain unchanged.

The following servers are intentionally left with temporary metadata at merge:

authSchemas at merge	Intended authSchemas after follow-up	Affected servers	Why the temporary state is required
Absent	["OAuth2", "AgentOnBehalfOfUser"]	Work IQ MCP and Azure Databricks Genie	Their final OAuth 2.0 and Agent on behalf of user capabilities cannot be published yet because the current frontend misreads explicit OAuth2 as User Entra token. Work IQ may therefore continue to appear incorrectly as supporting Managed identity, and neither entry advertises Agent on behalf of user yet. This is accepted temporarily to avoid exposing the wrong User Entra token connection path.
Absent	["OAuth2"]	Algolia, Amperity, ASC Recording Insights, Avalara AvaTax, Avalara Tax Registrations & Licenses, Avalara Classification, Avalara Cross-Border, Avalara Developer Documentation, Avalara E-Invoicing and Live Reporting, Avalara Exemption Certificates, Avalara Returns, Avalara Tax Content, Azure Managed Redis, Druva, IdeaLift, Lovable, MongoDB Atlas, Neo4j, Snowflake, and Stilingue Social Listening	Their explicit OAuth 2.0 capability is temporarily omitted because the current frontend misreads it as User Entra token. Concrete custom or connector-backed OAuth remains available. IdeaLift, ASC Recording Insights, and Azure Managed Redis may therefore appear incorrectly as supporting Managed identity; that catalog error is accepted temporarily because it is less harmful than offering an incorrect or nonfunctional User Entra token connection.

After this PR is merged, UX changes can occur to process this metadata accordingly, and the above entries can be updated to their intended state.

It is worth noting that Microsoft MCP Server for Enterprise temporarily has the wrong behavior and will surface UserEntraToken as an option (though correctly without runtime support) prior to the UX changes. However, its metadata is correct.