OAuth URLs on *.localhost hosts are rejected as insecure (SecureUrl loopback check too narrow) #619

SecureUrl::parse() accepts plain http only for the exact hosts localhost, 127.0.0.1 and ::1.
Every other http URL throws, including hosts that are loopback by definition:

• Names under the reserved .localhost TLD, such as shop.localhost.
  RFC 6761, section 6.3, reserves them for loopback, and the W3C Secure Contexts specification (and every major browser) treats *.localhost as a potentially trustworthy origin.
• IPv4 loopback addresses other than 127.0.0.1, such as 127.0.0.2.
  The whole 127.0.0.0/8 range is loopback, and Secure Contexts treats it as potentially trustworthy too.

SecureUrl backs ProtectedResourceMetadata (resource and authorization server URLs), OidcDiscovery (issuer and jwks_uri) and JwtTokenValidator::fromIssuer().
So a server running on a dev host like http://shop.localhost:8080 cannot build its protected resource metadata, and OAuth discovery breaks in local development.

Reproduce

use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;

new ProtectedResourceMetadata(
    resource: 'http://shop.localhost:8080/mcp',
    authorizationServers: ['http://shop.localhost:8080'],
);
// InvalidArgumentException: The resource "http://shop.localhost:8080/mcp" must use https;
// plain http is only accepted for loopback hosts.

Expected

Plain http is accepted for every loopback host (localhost, *.localhost, 127.0.0.0/8, ::1), and every other host still requires https.

The MCP authorization spec requires https for authorization server endpoints and allows redirect URIs to be "either localhost or use HTTPS" (Communication Security).
The SDK already relaxes this for loopback during development; the relaxation should cover all loopback hosts, not only three spellings of them.

Context

Shopware dev environments serve each checkout on http://<name>.localhost:<port>.
With SDK 0.9 the protected resource metadata route cannot be built there: shopware/shopware#21862