Merge pull request modelcontextprotocol#570 from modelcontextprotocol/pcarleton/auth-changelog

[spec] add changelog entries for auth spec changes

Author: ihrpr

docs/specification/draft/changelog.mdx

@@ -11,7 +11,8 @@ the previous revision, [2025-03-26](/specification/2025-03-26).
    (PR [#416](https://github.com/modelcontextprotocol/specification/pull/416)) 
 2. Added support for [structured tool output](https://modelcontextprotocol.io/specification/draft/server/tools#structured-content)
    (PR [#371](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/371))
-3. TODO
+3. Classified MCP servers as [OAuth Resource Servers](https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-authorization-server-discovery), adding protected resource metadata to discover the corresponding Authorization server. (PR [#338](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/338))
+4. Clarified [security considerations](https://modelcontextprotocol.io/specification/draft/basic/authorization#3-security-considerations) and best practices in the authorization spec and in a new [security best practices page](https://modelcontextprotocol.io/specification/draft/basic/security_best_practices).
 
 ## Other schema changes