feat: implement dynamic MCP HTTP headers via header factory

[Piyush0049]

Description

This PR refactors NewHeaderTransport in the upstream transport layer to use a headerFactory (func(context.Context) map[string]string) instead of a static map for HTTP headers.

Currently, the MCP remote client initializes with a static map[string]string. This means whatever headers are present at startup are permanently hardcoded into the HTTP client for its lifespan. By migrating to a header factory, this PR enables dynamic, context-aware resolution of HTTP headers per-request.

This is a critical architectural improvement that allows the agent to securely fetch fresh, short-lived tokens (like OAuth tokens) on every single request and pass dynamic execution metadata during MCP sessions.

Additional Fixes

• Windows Test Flakes: Fixed pre-existing Windows-specific test flakes in pkg/tools/mcp/keyringstore/tokenstore_test.go. The test assertions were updated to expect 0666 file permissions on Windows instead of Unix-style 0600. Go's os.Stat always reports ACLs as 0666 or 0444 natively on Windows, regardless of the mode passed to os.WriteFile. This keeps the test suite completely green for Windows contributors without weakening application security.

Testing

• Tested locally with task test
• Verified Windows file permission test failures are resolved
• Verified go build and go vet are completely clean