Migrate config controllers to MutateAndPatch helpers

[JAORMX]

Follow-up from #4777 (MCPAuthzConfig CRD)

The config-CRD controllers (MCPOIDCConfig, and now MCPAuthzConfig from #4777) still use raw r.Update / r.Status().Update() rather than the MutateAndPatchSpec / MutateAndPatchStatus helpers that .claude/rules/operator.md now mandates. #4777 deliberately mirrored the sibling MCPOIDCConfig controller for consistency and to avoid behavioral divergence in the stacked #4778.

Scope

• Migrate all config-CRD controllers to the MutateAndPatch* helpers together, so they stay consistent.

Context

• Flagged during the Add MCPAuthzConfig CRD for backend-agnostic authorization #4777 review. Doing it as a single sweep avoids one-off divergence.