security(mcp): prevent server requests from matching client pending responses (#942)

* security(mcp): prevent server requests from matching client pending responses

* fix(mcp): send courtesy -32601 reply asynchronously off read loop

* fix(mcp): restore jsonRPCIDEchoable and validate request IDs before responding

* fix(mcp): queue and drop courtesy replies without blocking client callers

* fix(mcp): drop canceled queued requests

* fix(mcp): preserve valid numeric request IDs

* fix(mcp): treat JSON method member presence as the request discriminator

An explicit empty method string is a request, not a response.
Courtesy -32601 is still dropped when the write queue is full: failAll
on that path stopped the reader and blocked inbound pipe writes
(TestStdioClientUndrainedServerDoesNotBlockCallerWithDeadline).

* fix(mcp): count dropped courtesy replies when the write queue is full

The inbound reader must not stop. An empty select default is now an
atomic counter rather than a silent discard.

* fix(mcp): retain method presence, writer lifecycle, and original JSON-RPC IDs

* fix(mcp): bound courtesy overflow, pin writer queue, match exponent IDs

* fix(mcp): skip SSE frames that carry a method member

Treat method presence the same on stdio and SSE so empty or null method
never completes a pending client request.

---------

Co-authored-by: cl-ment <cl-ment@example.com>
Co-authored-by: KRATOS <84986124+gnanam1990@users.noreply.github.com>

Author: 3 people