fix(mcp): merge per-request global variables with the stored ones (#14604)

Fixes #14602.

A request that overrode one global variable suppressed the database load
entirely, so every other header variable went unresolved. The gate added
with the header-variable feature keyed on `not request_variables` as well
as `has_headers`, which made the request payload the complete variable
universe rather than an overlay.

The failure is silent and lands in the credential path: `_resolve_global_
variables_in_headers` leaves an unmatched value untouched, so a header
bound to a non-overridden variable is sent upstream carrying the literal
variable name (`X-Auth2: AUTH-VAR2`) instead of the stored secret. The
user sees an upstream 401 with nothing in the logs pointing at the cause.

Gate the load on `has_headers` alone and merge, request values winning on
conflict. That matches how every other global-variable path already
resolves - `CustomComponent.get_variable` and `load_from_env_vars` both
check the request override for a given name, then fall back. The
optimization the gate was added for is untouched: header-less servers
still skip the query.

Tests: four cases covering the merge, the resulting header values, the
no-override baseline, and the preserved fast path. The two regression
cases fail on the parent commit.