test: enhance DeviceCodeOAuthFlowTest with immutability and equality edge cases

- Add Map.copyOf() defensive copy for scopes in DeviceCodeOAuthFlow record
- Add testScopesImmutability to verify defensive copying behavior
- Expand testEqualityAndHashCode with null refresh, different field values,
  null comparison, and type mismatch checks

Fixes #607

Author: neo1027144-creator

spec/src/main/java/io/a2a/spec/DeviceCodeOAuthFlow.java

@@ -33,5 +33,6 @@ public record DeviceCodeOAuthFlow(String deviceAuthorizationUrl, String tokenUrl
         Assert.checkNotNullParam("deviceAuthorizationUrl", deviceAuthorizationUrl);
         Assert.checkNotNullParam("tokenUrl", tokenUrl);
         Assert.checkNotNullParam("scopes", scopes);
+        scopes = Map.copyOf(scopes);
     }
 }

spec/src/test/java/io/a2a/spec/DeviceCodeOAuthFlowTest.java

@@ -77,13 +77,31 @@ void testConstruction_nullScopes_throwsException() {
     void testEqualityAndHashCode() {
         DeviceCodeOAuthFlow flow1 = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, REFRESH_URL, SCOPES);
         DeviceCodeOAuthFlow flow2 = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, REFRESH_URL, SCOPES);
-        DeviceCodeOAuthFlow flow3WithNullRefresh = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, null, SCOPES);
+        DeviceCodeOAuthFlow flow3 = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, null, SCOPES);
+        DeviceCodeOAuthFlow flow4 = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, null, SCOPES);
 
-        // Test for equality with same values
+        // Test for equality and hashCode consistency
         assertEquals(flow1, flow2);
         assertEquals(flow1.hashCode(), flow2.hashCode());
+        assertEquals(flow3, flow4);
+        assertEquals(flow3.hashCode(), flow4.hashCode());
+
+        // Test for inequality with different field values
+        assertNotEquals(flow1, flow3);
+        assertNotEquals(flow1, new DeviceCodeOAuthFlow("https://other.com", TOKEN_URL, REFRESH_URL, SCOPES));
+        assertNotEquals(flow1, null);
+        assertNotEquals(flow1, "not a flow");
+    }
 
-        // Test for inequality with different values
-        assertNotEquals(flow1, flow3WithNullRefresh);
+    @Test
+    void testScopesImmutability() {
+        Map<String, String> mutableScopes = new java.util.HashMap<>();
+        mutableScopes.put("read", "Read access");
+        DeviceCodeOAuthFlow flow = new DeviceCodeOAuthFlow(DEVICE_AUTH_URL, TOKEN_URL, REFRESH_URL, mutableScopes);
+
+        // Modifying the original map should not affect the record
+        mutableScopes.put("write", "Write access");
+        assertNotEquals(mutableScopes.size(), flow.scopes().size(),
+                "Record should be immutable and perform a defensive copy of the scopes map");
     }
 }