Add failing tests for JSON-encoded string heading targets

Some MCP clients do not resolve anyOf parameter schemas and forward the
raw JSON text of an array argument as a plain string. Because the
vault_read/vault_patch `target` union permits strings, that text passes
validation and then trips the handlers' array checks, making heading
targeting unusable from those clients entirely (#315).

These tests pin the intended accommodation: a heading target arriving as
a string that JSON-parses to an array of strings (or null, for
vault_patch's document root) is accepted as that value; a string that
does not parse that way is still rejected, but with an error that points
at anyOf client support instead of blaming the caller; and block/
frontmatter string targets are never JSON-parsed, since a string is
their legitimate type.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>