[Server] Reject malformed MCP session ID headers

[jstar0]

Summary

Fixes #380.

Malformed or repeated Mcp-Session-Id request headers currently reach UUID parsing inside StreamableHttpTransport, so client-supplied bad session metadata can surface as an internal server error.

Changes

• Reject repeated Mcp-Session-Id headers with 400 Bad Request.
• Reject malformed single Mcp-Session-Id values with 400 Bad Request.
• Keep valid, missing, and existing stale-session handling on the existing paths.
• Add regression coverage for malformed and duplicate session header inputs.

Verification

Focused regressions were also run for the malformed and duplicate session-id header cases.

make unit-tests
make phpstan
git diff --check

Risk

This is limited to invalid Streamable HTTP session-id request metadata. Valid session ids continue to be parsed as UUIDs, missing session ids still flow through the existing request handling, and well-formed but stale session ids still return the existing not-found response.

[chr-hertel]

Thanks for working on the patch @jstar0! Just one minor thing and we can merge it in 👍

[chr-hertel]

Let's be specific please and catch the Symfony\Component\Uid\Exception\InvalidArgumentException instead, that's what we're expecting.

[jstar0]

Narrowed the catch to Symfony\Component\Uid\Exception\InvalidArgumentException in d07b7ba. The focused session-header regressions, full transport test, full unit suite, style check, and PHPStan all pass.

[jstar0]

The supported dependency matrix showed that the namespaced exception is not available on Symfony UID 5.4/6.4: PHPStan reported the caught class as missing, and those jobs still throw the global InvalidArgumentException from Uuid::fromString(). I restored the common parent catch and documented the version split in bc1d3bc. Newer UID exceptions subclass that parent, and the catch remains scoped directly around Uuid::fromString(), so this covers all supported Symfony versions without broadening the surrounding request handling.