Backport of "Fix MCP OAuth Protected Resource Metadata resource field to return string instead of array"

What does this MR do and why?

Backports !250085 (merged) to 19-3-stable-ee.

Fixes the resource field in the OAuth Protected Resource Metadata endpoint to return a single string instead of an array, per RFC 9728. Strict OAuth clients (Gemini CLI, Windsurf) failed to parse the array form.

Closes #596356 (closed)

How to test locally

• Cherry pick applies cleanly with no conflicts, verified in a clean worktree against 19-3-stable-ee.
• Confirmed the resulting protected_resource_metadata_controller.rb and its spec are byte-identical between the 19.3 and 19.2 backports.
• ruby -c passes on the changed controller and spec files.
• The original fix is already merged and deployed to GitLab.com; this is a straight backport with no adaptation needed.

MR acceptance checklist

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The MR that fixed the bug on the default branch has been deployed to GitLab.com (not applicable for documentation or spec changes).
• The MR title is descriptive (e.g. "Backport of 'title of default branch MR'"). This is important, since the title will be copied to the patch blog post.
• Required labels have been applied to this merge request
  • severity and Customer Interest labels applied
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded, or if it has failed, investigate the failures.