fix(auth): accept Cursor's registration with a cursor:// callback until November

[mattzcarey]

Some Cursor versions register three callbacks:

cursor://anysphere.cursor-mcp/oauth/callback
https://www.cursor.com/agents/mcp/oauth/callback
http://localhost:<port>/callback

workers-oauth-provider 1.2 (#236) refuses the whole registration because of the cursor:// one. The dcr_refused logging from #237 counted 66 refused Cursor registrations in the first 77 minutes, from the IDE (node), the agent daemon (Cursor/1.0.0) and Cursor 3.3.30 on Linux. On 0.10 those registrations went through and Cursor signed in with its loopback callback, so this is a regression.

allowPrivateUseRedirectUris: true restores 0.10's behavior:

	0.10	1.2 (main)	This PR
Cursor's three-callback registration	201	400	201
Sign in with its loopback callback	consent page	(no client)	consent page
Authorize with cursor://…	refused locally by our own check	(no client)	refused locally by our own check
Register with a remote http callback	201, refused at /authorize	400	400

Our own /authorize check (isAllowedOAuthRedirectUri) still only allows https or loopback. So a custom scheme can sit in a registration, but it never receives a code. Clients that register only a custom scheme (Claude Code's claude://, CodeBuddy, WorkBuddy, Warp) now register, then fail at /authorize exactly as they did on 0.10.

There's a TODO to remove this in November, once people have upgraded Cursor. Cursor 3.22.7 registers only the https and loopback callbacks.

tests/auth/private-use-redirects.test.ts runs end to end through the worker. Without the option, Cursor's registration gets 400.

In cimd.test.ts, the ftp:// and com.example.client:/ cases are now refused by our own check instead of the provider, so they expect its message. They still get a 400, no redirect and no grant.

[mattzcarey]

Replaced by #241: workers-oauth-provider 1.2.1 accepts Cursor's registration without allowPrivateUseRedirectUris (cloudflare/workers-oauth-provider#391), and #241 drops our duplicate redirect check.