mcp: expose streamable HTTP request summaries

[CaliLuke]

Streamable HTTP middleware can observe HTTP lifecycle information, but it cannot safely obtain JSON-RPC message metadata from the SDK-authoritative parse without reading and parsing the request body again. That duplicates buffering and risks retaining sensitive parameters.

This change adds a redacted StreamableHTTPRequestSummary and an OnRequestSummary callback to StreamableHTTPOptions. The callback runs synchronously after the session transport decodes a POST body and before validation or dispatch of those decoded messages. It exposes only ordered method names, a single-call request ID, and call/notification/response counts. It adds no request-body reads, replacements, or buffering.

The callback receives the HTTP request context for middleware correlation. Its documentation describes concurrency, early HTTP/session/connection rejection gaps, attacker-controlled method strings, panic behavior, and its relationship to Server.AddReceivingMiddleware.

Verification:

• gofmt -l .
• go vet ./...
• staticcheck v0.6.1 and v0.7.0
• go test ./... with Go 1.25 and Go 1.26.5
• go test -race ./...
• go generate ./...
• pinned stateful, stateless, and client MCP conformance suites
• govulncheck with Go 1.26.5

Fixes #1076