Add missing permission_callback to REST route registrations

WordPress 5.5 requires permission_callback on all REST routes.
Both public endpoints get __return_true since they handle their own
authentication internally.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: joehoyle

inc/endpoints/class-token.php

@@ -20,9 +20,10 @@ public function register_routes() {
 			'oauth2',
 			'/access_token',
 			[
-				'methods'  => 'POST',
-				'callback' => [ $this, 'exchange_token' ],
-				'args'     => [
+				'methods'             => 'POST',
+				'callback'            => [ $this, 'exchange_token' ],
+				'permission_callback' => '__return_true',
+				'args'                => [
 					'grant_type'    => [
 						'required'          => true,
 						'type'              => 'string',

inc/endpoints/namespace.php

@@ -23,8 +23,9 @@ function register() {
 		'oauth2',
 		'/authorize',
 		[
-			'methods'  => 'GET',
-			'callback' => __NAMESPACE__ . '\\redirect_to_authorize',
+			'methods'             => 'GET',
+			'callback'            => __NAMESPACE__ . '\\redirect_to_authorize',
+			'permission_callback' => '__return_true',
 		]
 	);
 }