Enable feature flags via URL query parameter (?features=) for headerless hosted connections (#3146)

* fix(http): preserve feature query across OAuth resource metadata

Review on #3146 identified that a query-bearing MCP server URL breaks
OAuth protected-resource metadata discovery: go-sdk v1.7.0 validates
metadata.resource with exact string equality against the full server
URL, but BuildResourceMetadataURL and buildResourceURL dropped the
request's RawQuery, so clients connecting to e.g.

  /mcp/x/issues?features=issue_dependencies

received challenge and metadata URLs without the query and could reject
the metadata as belonging to a different resource (RFC 9728).

- Preserve r.URL.RawQuery in both the advertised resource_metadata URL
  and the metadata document's resource via a shared AppendQuery helper.
- Make feature selection presence-based: the features query parameter
  and the X-MCP-Features header are separate channels that are never
  combined; query wins when both are present.
- Extend TestOAuthChallengeMetadataRouteContracts with a query-bearing
  MCP URL round-trip (challenge URL + metadata.resource exact match).
- Add TestWithRequestConfigFeatureSelection covering all four channel
  combinations, plus unit tests for query preservation in
  TestBuildResourceMetadataURL.

* fix(http): give feature header precedence over query

* fix(http): harden URL feature flag handling

Preserve exact OAuth resource queries across route variants, retain presence-based header precedence, and mark feature-dependent responses with Vary.

Expand request, allowlist, metadata, route, and cache behavior coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com>
Co-authored-by: Sam Morrow <sammorrowdrums@github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>