fix: prevent streamable HTTP session leak

[DaleSeo]

Motivation and Context

The stateful Streamable HTTP server could allocate a local session before rejecting an invalid initial POST. This change validates that an initial stateful POST is an initialize request, checks the MCP-Protocol-Version header against the initialize body, and only creates a session after those checks pass. That keeps rejected pre-initialize requests from leaving entries behind in LocalSessionManager.

How Has This Been Tested?

Added tests

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed