- This removes the requirement to configure data protection which is the motivating reason for this change
- This means that McpServer.ClientInfo will always be null in stateless mode
- It allows a single MCP session spanning multiple requests
to be handled by different servers without sharing state
- It does require the servers share data protection keys, but this
is standard for ASP.NET Core cookies and antiforgery as well
- It immediately throws for unsupported operations like sampling
