fix(http)!: enforce Origin validation semantics

[lucarlig]

Enforces the MCP 2026-07-28 Origin-validation requirements while retaining an explicit opt-out for deployments that intentionally accept arbitrary Origins.

Motivation and Context

The MCP 2026-07-28 Streamable HTTP specification requires servers to validate every present Origin header and return HTTP 403 Forbidden when it is invalid.

RMCP currently skips validation when allowed_origins is empty and returns HTTP 400 for malformed or non-UTF-8 values. This change:

• enables Origin validation by default
• treats an empty allowed_origins list as allowing no present Origin values
• returns HTTP 403 for malformed and non-UTF-8 Origin headers
• preserves disable_allowed_origins() as the explicit validation opt-out

Requests without an Origin header continue to pass, so non-browser MCP clients are unaffected.

Closes #1191.

How Has This Been Tested?

• cargo +nightly fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features — 783 passed, 24 ignored
• RMCP's CI-equivalent all-features-except-local matrix
• Focused Origin-validation suite — 12 passed
• JavaScript and Python interoperability tests included in the full matrix

Breaking Changes

Browser requests carrying an Origin header no longer pass under the default empty allowlist. Deployments must configure accepted origins with with_allowed_origins(...) or explicitly opt out with disable_allowed_origins().

Requests without an Origin header are unchanged.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Existing Origin port-matching behavior is intentionally unchanged because the MCP specification does not define allowlist matching semantics.

[lucarlig]

@DaleSeo, could you approve the first-time-contributor CI, CodeQL, and Conformance runs and review this Origin-validation fix? The intended behavior is documented in #1191, the compatibility change is explicitly marked breaking, and the CI-equivalent test suite passes locally.