Add jwtDecoder

Author: Stanislav Deviatykh

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/config/McpServerOAuth2Configurer.java

@@ -54,7 +54,7 @@ public class McpServerOAuth2Configurer extends AbstractHttpConfigurer<McpServerO
 
 	private boolean validateAudienceClaim = false;
 
-	private Consumer<NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder> jwtDecoderCustomizer = null;
+	private NimbusJwtDecoder decoder = null;
 
 	public McpServerOAuth2Configurer authorizationServer(String issuerUri) {
 		this.issuerUri = issuerUri;
@@ -92,8 +92,8 @@ public McpServerOAuth2Configurer validateAudienceClaim(boolean validateAudienceC
 		return this;
 	}
 
-	public McpServerOAuth2Configurer jwtDecoderCustomizer(Consumer<NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder> jwtDecoderCustomizer) {
-		this.jwtDecoderCustomizer = jwtDecoderCustomizer;
+	public McpServerOAuth2Configurer jwtDecoder(NimbusJwtDecoder decoder) {
+		this.decoder = decoder;
 		return this;
 	}
 
@@ -108,24 +108,22 @@ public void init(HttpSecurity http) throws Exception {
 			.setProtectedResourceMetadataCustomizer(getProtectedMetadataCustomizer());
 
 		var entryPoint = new BearerResourceMetadataTokenAuthenticationEntryPoint(this.resourceIdentifier);
+		var jwtDecoder = buildJwtDecoder();
 
 		//@formatter:off
 		http
 				.oauth2ResourceServer(resourceServer -> {
-					resourceServer.jwt(jwt -> jwt.decoder(getJwtDecoder(http)));
+					resourceServer.jwt(jwt -> jwt.decoder(jwtDecoder));
 					resourceServer.authenticationEntryPoint(entryPoint);
 				})
 				.addFilterBefore(protectedResourceMetadataEndpointFilter, AbstractPreAuthenticatedProcessingFilter.class);
 		//@formatter:on
 	}
 
-	private JwtDecoder getJwtDecoder(HttpSecurity http) {
-		var builder = NimbusJwtDecoder.withIssuerLocation(this.issuerUri);
-		if (this.jwtDecoderCustomizer != null) {
-			this.jwtDecoderCustomizer.accept(builder);
-		}
-
-		var decoder = builder.build();
+	private JwtDecoder buildJwtDecoder() {
+		var decoder = this.decoder != null
+			? this.decoder
+			: NimbusJwtDecoder.withIssuerLocation(this.issuerUri).build();
 
 		if (this.validateAudienceClaim) {
 			OAuth2TokenValidator<Jwt> jwtValidator = JwtValidators