Add MCP header safety guardrails

[gandhipratik203]

Summary

• Add configurable MCP standard header limits for count, per-value bytes, and approximate total bytes.
• Reject excessive MCP standard headers with HTTP 431 before auth, config lookup, or RMCP body parsing.
• Protect computed MCP standard headers from backend header config passthrough/add/remove.
• Document the limits and protected-header policy in the gateway book.

Explanatory Diagrams

MCP client
   |
   | POST /contextforge-rs/servers/{virtual_host}/mcp
   | Mcp-Method / Mcp-Name / Mcp-Protocol-Version / Mcp-Param-*
   v
Dataplane gateway
   |
   | mcp_origin_layer
   | CORS
   | mcp_header_limits_layer
   |
   | Checks MCP standard headers before auth/config/RMCP work:
   | - header count
   | - per-value size
   | - approximate total MCP header bytes
   v

Within limits                         Over limit
-------------                         ----------
continue request                      HTTP 431
                                      no body parsing
                                      no JWT validation
                                      no UserConfig lookup
                                      no header values logged

   |
   v
Normal gateway flow
   |
   | virtual host extraction
   | JWT validation
   | session/config lookup
   | RMCP request handling
   v
Backend routing
   |
   | Backend config may copy/add/remove normal headers
   | such as Authorization or custom X-* headers.
   |
   | But backend config cannot copy, add, or remove
   | MCP headers owned by the gateway/RMCP:
   | - Mcp-Method
   | - Mcp-Name
   | - Mcp-Protocol-Version
   | - Mcp-Param-*
   v
Backend MCP server

Context

Closes IBM/mcp-context-forge#6146.

Validation

• cargo +1.96 fmt
• cargo +1.96 test -p contextforge-data-plane-lib
• cargo +1.96 clippy --locked --workspace --all-targets -- -D warnings

Note: plain cargo clippy --locked --workspace --all-targets -- -D warnings uses the local default Rust 1.93.1 in this checkout and fails before clippy because the workspace requires Rust 1.96.

[lucarlig]

Requesting changes for the MCP 2026-07-28-only target:

• Override supported_protocol_versions() so server/discover advertises only 2026-07-28 and every other version is rejected.
• Remove the downstream initialize/session dependency. MCP 2026-07-28 removed both, but routed calls currently require Mcp-Session-Id and backend transports are created only during initialize.
• Remove Mcp-Session-Id from the standard-header limit classification and documentation; it is not part of the 2026-07-28 transport.

The header-limit accounting, middleware ordering, and computed-header protection otherwise look good. Fresh library tests and focused Clippy checks pass.

Dismissed because the requested changes were broader MCP 2026-07-28 migration work explicitly excluded from IBM/mcp-context-forge#6146.

[lucarlig]

Correction after checking the linked issue: modern sessionless routing and 2026-07-28-only enforcement are explicitly out of scope for IBM/mcp-context-forge#6146; they are tracked by #5679, #5680, and #6148.

For this PR’s actual scope—MCP header count/value guardrails, early rejection, protection of computed headers, hop-by-hop coverage, and documentation—the implementation looks good. Fresh library tests and focused Clippy checks pass.

Non-blocking: if Mcp-Session-Id remains covered by the guardrail, describe it as a legacy header rather than a 2026-07-28 standard header.

[lucarlig]

LGTM