Validate origin header

[Kehrlann]

Fixes #695 . Updates conformance tests.

Contents

Add Origin header validation for HTTP-based MCP server transports so servers can restrict which origins can connect (e.g. browser or cross-origin clients).

Introduces new ServerTransportSecurityValidator interface, to validate transport-level security. Default behavior stays permissive: transports use ServerTransportSecurityValidator.NOOP unless a validator is set via the builder.

The provided implementation is DefaultServerTransportSecurityValidator and only validates the Origin header, for now.

New APIs: example usage

HttpServletStreamableServerTransportProvider.builder()
// ...
.securityValidator(
    DefaultServerTransportSecurityValidator.builder()
        .allowedOrigin("http://localhost:*")
        .build())
// ...

Points of interest

Integration tests use the new JUnit 6 @ParameterizedClass API, which is another way of implementation "abstract base classes" for tests.