mcp: expose streamable HTTP request summaries

[CaliLuke]

Streamable HTTP middleware can observe HTTP lifecycle information, but it cannot safely obtain JSON-RPC message metadata from the SDK-authoritative parse without reading and parsing the request body again. That duplicates buffering and risks retaining sensitive parameters.

This change adds a redacted StreamableHTTPRequestSummary and an OnRequestSummary callback to StreamableHTTPOptions. The callback runs synchronously after the session transport decodes a POST body containing a single JSON-RPC message and before validation or dispatch. It is not invoked for deprecated JSON-RPC batches. The summary exposes only the method, a call request ID, and notification/response classification. It adds no request-body reads, replacements, or buffering.

The callback receives the HTTP request context for middleware correlation. Its documentation describes concurrency, early HTTP/session/connection rejection gaps, attacker-controlled method strings, panic behavior, and its relationship to Server.AddReceivingMiddleware.

Verification:

• gofmt -l ., go build ./..., go vet ./..., and staticcheck v0.8.0-rc.1 with Go 1.27.1
• go test ./... with Go 1.25.0 and Go 1.27.1
• go test -race ./... with Go 1.26.6
• go generate ./... leaves the worktree clean
• CI-pinned MCP conformance suite 0.2.0-alpha.11: stateful server (2025-11-25), stateless server (2026-07-28), and the full client suite all pass the repository baseline checks. Results: 82 stateful assertions passed; 164 stateless assertions passed with 30 expected failures; 470 client assertions passed with 13 expected failures.

Fixes #1076

[CaliLuke]

@guglielmo-san could you let the tests run on this PR?

[CaliLuke]

@guglielmo-san caught up, this is mergeable again