[Server][Tests] Complete the multi round-trip request flow (SEP-2322) (#446)

The revision has no way for a server to put a request on a response stream,
so a handler that needs input from the user says so in its result instead: a
handler returning InputRequiredResult comes back as
resultType: "input_required" with the asks and an opaque requestState, and
the client retries the same request carrying inputResponses.

RequestContext::getInputContext() is what the handler reads them through.
RequestStateCodec signs and time-bounds the state, so a tampered or expired
one is refused rather than trusted - the state travels through the client,
which is not a place to keep something the server later believes.

src/Schema/Enum/CacheScope.php

@@ -14,13 +14,9 @@ namespace Mcp\Schema\Enum;
 /**
  * How widely a cacheable result may be reused (SEP-2549).
  *
- * The analogue of HTTP's `Cache-Control: public` vs `private`. The distinction
- * is a security boundary, not a performance knob: marking a result public
- * allows shared gateways and proxies to serve it to *other* authorization
- * contexts, so anything shaped by who asked must stay private.
- *
- * {@see self::Private} is therefore the default everywhere in this SDK — an
- * over-cautious hint costs a cache hit, an over-broad one leaks a response.
+ * A security boundary, not a performance knob: `public` lets shared caches
+ * serve the result to other authorization contexts, so anything shaped by who
+ * asked must stay private — which is why private is the default throughout.
  *
  * @author Christopher Hertel <mail@christopher-hertel.de>
  */