public oauth client should always support localhost callback

[jaingounchained]

Summary

Public static OAuth clients defined in the Dex configuration currently do not support wildcard redirect URIs. This creates a compatibility issue when adding support for MCP clients that require fixed, non-localhost callback URLs, such as:

• cursor://anysphere.cursor-mcp/oauth/callback
• https://beta.app.kiro.dev/agent/mcp/callback
• https://gamma.app.kiro.dev/agent/mcp/callback
• https://app.kiro.dev/agent/mcp/callback

If these redirect URIs are explicitly configured, OAuth clients that rely on localhost-based callback URLs will no longer be able to authenticate successfully.

Change

Enable support for any localhost callback URL for public static OAuth clients while continuing to allow explicitly configured redirect URIs required by MCP clients.

Motivation

This change ensures compatibility with both:

1. MCP clients that require fixed callback URLs (e.g. Cursor and Kiro).
2. Existing OAuth clients that use dynamic localhost redirect URIs during local development.

Without this change, adding support for MCP-specific redirect URIs would break authentication flows for clients that depend on localhost callbacks.