Replace concrete collection types with interfaces in public API surface

[Copilot]

Public API properties were exposing concrete collection types (List<T>, T[]) instead of IList<T>.

• ProtectedResourceMetadata: 6 properties changed from List<string> to IList<string> (AuthorizationServers, BearerMethodsSupported, ScopesSupported, ResourceSigningAlgValuesSupported, AuthorizationDetailsTypesSupported, DpopSigningAlgValuesSupported)
• ToolResultContentBlock: Content changed from List<ContentBlock> to IList<ContentBlock>
• ListTasksResult: Tasks changed from McpTask[] to IList<McpTask>
• DynamicClientRegistrationResponse: 3 properties changed from string[]? to IList<string>? (RedirectUris, GrantTypes, ResponseTypes)

AuthorizationServerMetadata and DynamicClientRegistrationRequest also use concrete collection types but are internal sealed, so left as-is. All dictionaries and sets in the public API already use interface types.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[stephentoub]

@copilot, any dictionaries or sets?

[Copilot]

@copilot, any dictionaries or sets?

Checked all public.*Dictionary<, public.*HashSet<, public.*SortedSet<, public.*SortedDictionary<, and public.*ConcurrentDictionary< in src/. All dictionaries in public API already use IDictionary<> or IReadOnlyDictionary<>. No HashSet<>, SortedSet<>, SortedDictionary<>, or ConcurrentDictionary<> appear in public API at all.

[stephentoub]

@copilot any more lists or arrays?

[Copilot]

@copilot any more lists or arrays?

Found two more: ListTasksResult.Tasks was McpTask[] and DynamicClientRegistrationResponse had three string[]? properties (RedirectUris, GrantTypes, ResponseTypes). All changed to IList<T> in 3782009.

[halter73]

I considered more changes to IList when you had me change the filter types, but I wasn't sure if we had different conventions for JSON DTOs. I don't see any reason why not to use IList though.

[jeffhandley]

Thanks, I noticed this during an audit last night and was going to ask about it today; but you've already fixed it. :-)