Fix MSRC-112281: SSRF (#79)

* Tool registration (POST/PUT /tools): validate ToolDefinition.Port
(1-65535) and ToolDefinition.Path against a strict allowlist
(^/[a-zA-Z0-9/_\-\.]*$), preventing URI authority/query/fragment
injection.
* Tool execution (HttpToolExecutor): build the downstream endpoint URL
with UriBuilder from discrete host/port/path components instead of
string interpolation. The cluster-internal host stays pinned even if a
malicious record were to bypass the registration validator.
* Adapter session routing: scope every session-store key with the
authenticated user id (BuildScopedSessionKey -> "userId:sessionId") and
reject untrusted adapter-supplied session ids that fall outside
^[a-zA-Z0-9\-]{1,128}$ (IsValidSessionId). A second user replaying
another user's mcp-session-id now misses the scoped key instead of being
routed into the original user's pod.

Adds new unit tests for each guard (port range, path allowlist on Create
and Update, scoped-key lookup, IsValidSessionId/BuildScopedSessionKey
edge cases) and a runtime validation script + evidence report under
docs/security/ that reproduces the fixes against the local kind cluster.

Co-authored-by: Lili Xu <lilx@microsoft.com>