[Server] Compose StreamableHttpTransport security middleware via defaultMiddleware() factory

[sveneld]

Summary

Replaces the implicit instanceof + array_unshift injection of CORS handling in StreamableHttpTransport with an explicit, composable PSR-15 stack exposed through a public StreamableHttpTransport::defaultMiddleware() factory. Adds three middleware that together cover the recommended HTTP-level hardening for MCP Streamable HTTP:

• CorsMiddleware — secure-by-default (no Access-Control-Allow-Origin header is set; cross-origin browser requests are blocked). Configurable allowedOrigins reflect a matching origin and automatically emit Vary: Origin so shared caches don't poison.
• DnsRebindingProtectionMiddleware — validates Origin/Host against an allowlist of hostnames (localhost variants by default).
• ProtocolVersionMiddleware — rejects requests carrying an unsupported Mcp-Protocol-Version header with 400 Bad Request (spec compliance).

The transport itself becomes oblivious to the middleware list. The $middleware constructor argument is nullable:

Passed value	Effect
omitted / null	Default secure stack from StreamableHttpTransport::defaultMiddleware()
[]	No middleware at all (e.g. when fronted by an application that already handles CORS/host validation)
explicit list	Used verbatim; mix and match by spreading ...StreamableHttpTransport::defaultMiddleware()

SESSION_HEADER and a new PROTOCOL_VERSION_HEADER are promoted to public constants on the transport so middleware can reuse them without duplicating string literals.

Why this design

The three open items below all reach for the same shape — a piece of mandatory security logic that the transport should apply unless the user opts out. PRs #260 and #277 each implement this with their own instanceof MyMiddlewareClass check + array_unshift inside the transport constructor. That pattern scales linearly with the number of "mandatory" middleware and breaks once a user supplies a custom implementation of the same concern under a different class name. Adding ProtocolVersionMiddleware for #306 would mean a third copy of the same pattern.

This PR collapses all three into a single composition model: the transport is a thin PSR-15 host, and the recommended stack lives in a factory the user can spread, filter, or replace. No instanceof magic, no surprise prepending, no position arguments to bypass.

Relation to other work

• [Server] Extract CORS handling into CorsMiddleware #277 (Extract CORS handling into CorsMiddleware) — same goal of replacing the inline withCorsHeaders() post-hook with a PSR-15 middleware. This PR additionally drops the instanceof CorsMiddleware auto-prepend in favour of defaultMiddleware() composition (which is what @CodeWithKyrian suggested in #277 review and @chr-hertel agreed with). Also addresses Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *) #280 (wildcard CORS default) the same way [Server] Extract CORS handling into CorsMiddleware #277 does — Access-Control-Allow-Origin is no longer set by default. Adds Vary: Origin when reflecting a specific origin, which [Server] Extract CORS handling into CorsMiddleware #277 doesn't.
• [Server] Add DNS rebinding protection feature with middleware #260 (DNS rebinding protection) — same middleware concept and default allowlist (localhost, 127.0.0.1, [::1], ::1); avoids the instanceof DnsRebindingProtectionMiddleware auto-prepend pattern for the same scalability reason.
• Streamable HTTP accepts unsupported or malformed MCP-Protocol-Version headers instead of returning 400 #306 (Unsupported MCP-Protocol-Version accepted) — new ProtocolVersionMiddleware rejects with 400 Bad Request per spec. Tolerates a missing header (initialize round-trip / legacy clients don't send it); strict per-session version-match validation is out of scope for an HTTP-layer middleware and can be layered on if maintainers want it.

If maintainers prefer to land #260 / #277 separately first, this PR can be rebased onto them and reduced to the composition refactor + ProtocolVersionMiddleware. Happy to do that.

BC breaks

• StreamableHttpTransport::__construct — the $corsHeaders parameter is removed. The $middleware parameter consequently shifts one position. Positional callers passing the old $corsHeaders argument will get a TypeError at construction; switch to named arguments or drop the argument. logger/middleware are now positions 4/5 instead of 5/6.
• Default Access-Control-Allow-Origin is no longer *. Browser clients on a different origin will be blocked unless CorsMiddleware is configured with explicit allowedOrigins.

CHANGELOG.md entry added under 0.6.0.

Test plan

• vendor/bin/phpunit --testsuite=unit — 38 new/updated tests pass (3 middleware × ~10 tests each + transport integration). Full suite: 1 error + 2 failures are pre-existing on upstream/main (DocBlockParserTest missing Composer\Semver\VersionParser dev-dep, two DiscoveryTest fixtures) — verified by running the same tests against vanilla main with the branch stashed.
• vendor/bin/php-cs-fixer fix --dry-run — clean
• vendor/bin/phpstan analyse — clean for changed code; the one pre-existing error in DocBlockParserTest (missing dev-dep Composer\Semver\VersionParser) is unchanged
• Both OAuth examples (oauth-keycloak, oauth-microsoft) updated to spread the default stack so their behaviour is preserved