[Server][Tests] Validate the standard MCP request headers (SEP-2243) (#445)

The revision puts the method, the subject name and the mirrored arguments in
headers so an intermediary can route and cache without parsing the body. A
header that contradicts the body it travels with therefore has to be
refused, not ignored: StandardHeaderValidator compares each against the
request and answers -32020 on a mismatch.

Set with Builder::setHeaderValidator(); a transport with no header layer is
unaffected.

src/Server/Stateless/StatelessProtocol.php

@@ -90,6 +90,7 @@ final class StatelessProtocol
         private readonly LoggerInterface $logger = new NullLogger(),
         private readonly float $subscriptionLifetime = 30.0,
         ?WireCodecInterface $codec = null,
+        private readonly ?StandardHeaderValidator $headerValidator = null,
     ) {
         $this->codec = $codec ?? new Rev2026Codec($configuration->serverInfo);
     }
@@ -140,6 +141,14 @@ final class StatelessProtocol
             return $versionError;
         }
 
+        // After the version is settled, because a peer on the wrong revision
+        // has a more fundamental problem than a header that disagrees with its
+        // body — and telling it about the headers first would send it fixing
+        // the wrong thing.
+        if (null !== $headerError = $this->headerValidator?->validate($method, $params, $headers)) {
+            return StatelessResult::error(Error::forHeaderMismatch($headerError, $id), 400);
+        }
+
         if (self::DISCOVER_METHOD === $method || self::LISTEN_METHOD === $method) {
             // Both answer with a single response tied to this request's id,
             // unlike a genuine notification — so unlike the general dispatch