feat(mcp-tools-acl): restrict the MCP tools a consumer may see and call

[AlinsRan]

Description

openapi-to-mcp turns every operation of an OpenAPI document into a tool, and a route serving it hands the whole set to whoever connects. That is rarely what a given client should get: a read-only agent has no business calling deletePet, and it should not even be told the tool exists.

mcp-tools-acl narrows that set per consumer. It runs at priority 539 — below openapi-to-mcp (540) and below the auth plugins, so the consumer is already known when a rule is matched. It:

• refuses a tools/call for a tool the matched rule does not allow, so the API is never called;
• removes the same tools from the tools/list answer, over both transports — the JSON body of a streamable_http answer, and the SSE events of an sse one, buffering an incomplete event across body_filter chunks.

Rules are selected per request with lua-resty-expr, so one route can serve a different tool set to each consumer. A rule without an expression always matches; when no rule matches, nothing is enforced.

{
  "mcp-tools-acl": {
    "rules": [
      { "expr": [["consumer_name", "==", "reader"]], "allow_tools": ["getPetById"] },
      { "deny_tools": ["deletePet"], "rejected_msg": "deletePet is not allowed" }
    ]
  }
}

openapi-to-mcp gains one line, ctx.openapi_to_mcp_active = true. The ACL plugin has no other way to tell an MCP conversation from an ordinary route — the request body alone looks the same — and on a route without openapi-to-mcp it now stands aside with a warning rather than trying to police plain JSON.

This is the plugin API7 Enterprise has been shipping, contributed here unchanged. Its tests are new: the enterprise suite drives the Node sidecar that build used, which says nothing about the in-process implementation this repository has, so the suite was rewritten against lib.openapi_to_mcp_fixture.

Which issue(s) this PR fixes

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)