fix: improve DCR consistency and safety

[telegrapher]

Summary

• Fix JSON injection vulnerability in DCR payload construction — replaced manual string concatenation with json.Marshal for proper escaping of client names and redirect URIs.
• Use httpClient() instead of http.DefaultClient so proxy, TLS, and timeout settings apply to DCR requests.
• Simplify Register() return type from RegisterResponse{StatusCode, Body} to (string, error), matching all other commands in the package.
• Add URL validation via validateURL() to DCR config validation.
• Fix error wrapping (%v → %w) across DCR files for proper error chain propagation.
• Add missing Apache 2.0 license headers to ims/register.go, ims/client.go, and cmd/dcr.go.
• Output pretty-printed JSON instead of raw body + status code, consistent with other commands.