[Server][Tests] Complete the multi round-trip request flow (SEP-2322) (#446)

The revision has no way for a server to put a request on a response stream,
so a handler that needs input from the user says so in its result instead: a
handler returning InputRequiredResult comes back as
resultType: "input_required" with the asks and an opaque requestState, and
the client retries the same request carrying inputResponses.

RequestContext::getInputContext() is what the handler reads them through.
RequestStateCodec signs and time-bounds the state, so a tampered or expired
one is refused rather than trusted - the state travels through the client,
which is not a place to keep something the server later believes.

tests/Unit/Server/Stateless/StandardHeaderValidatorTest.php

@@ -23,8 +23,7 @@ class StandardHeaderValidatorTest extends TestCase
     protected function setUp(): void
     {
         // No registry: the Mcp-Param dimension needs tool definitions and is
-        // covered by the conformance fixture, which has real ones. Everything
-        // here is registry-independent.
+        // covered by the conformance fixture.
         $this->validator = new StandardHeaderValidator();
     }
 
@@ -125,8 +124,6 @@ class StandardHeaderValidatorTest extends TestCase
         yield 'resources/read uses uri' => ['resources/read', ['uri' => 'test://c'], 'test://c'];
         yield 'tasks/get uses taskId' => ['tasks/get', ['taskId' => 'd'], 'd'];
         yield 'tools/list has no subject' => ['tools/list', [], null];
-        // A non-string value is not a name: treating it as one would compare a
-        // header against something that was never a header value.
         yield 'non-string name is ignored' => ['tools/call', ['name' => 42], null];
     }
 
@@ -146,10 +143,8 @@ class StandardHeaderValidatorTest extends TestCase
     #[DataProvider('malformedBase64')]
     public function testMalformedBase64IsRefused(string $encoded): void
     {
-        // PHP's decoder will happily return bytes for most of these. Accepting
-        // them would let a corrupted header silently compare equal — or, worse,
-        // silently unequal — instead of being reported as the transport-level
-        // fault it is.
+        // PHP's decoder returns bytes for most of these; accepting them would
+        // let a corrupted header silently compare equal.
         $this->assertNull(StandardHeaderValidator::decode('=?base64?'.$encoded.'?='));
     }