[Server] Reject malformed MCP session ID headers

[jstar0]

Summary

Fixes #380.

Malformed or repeated Mcp-Session-Id request headers currently reach UUID parsing inside StreamableHttpTransport, so client-supplied bad session metadata can surface as an internal server error.

Changes

• Reject repeated Mcp-Session-Id headers with 400 Bad Request.
• Reject malformed single Mcp-Session-Id values with 400 Bad Request.
• Keep valid, missing, and existing stale-session handling on the existing paths.
• Add regression coverage for malformed and duplicate session header inputs.

Verification

Focused regressions were also run for the malformed and duplicate session-id header cases.

make unit-tests
make phpstan
git diff --check

Risk

This is limited to invalid Streamable HTTP session-id request metadata. Valid session ids continue to be parsed as UUIDs, missing session ids still flow through the existing request handling, and well-formed but stale session ids still return the existing not-found response.