fix: validate MCP-Protocol-Version header in servlet transports

[ez-lbz]

The streamable HTTP spec requires the server to answer with 400 Bad Request when the client sends an unsupported MCP-Protocol-Version header, and to accept the request when the header is missing (falling back to the negotiated version). The Servlet-based providers never read this header.

This change validates the MCP-Protocol-Version header in doGet, doPost, and doDelete of HttpServletStreamableServerTransportProvider and in doPost of HttpServletStatelessServerTransport, rejecting unsupported versions with a 400 JSON error response consistent with the existing error style.

Tests cover the version-header matrix (supported version accepted, unsupported version rejected, missing header accepted) across both providers.

[slachiewicz]

Heads-up on overlap: #1112 implements SEP-2243 end to end for the servlet transports, including the MCP-Protocol-Version validation this PR adds, following the ask in #990 to land the SEP as one piece. It exempts initialize and returns INVALID_REQUEST on an unsupported version. If you would rather carry the protocol-version part yourself, say so and I will drop that slice from #1112.

This comment was created with AI assistance.