rmcp: return forbidden for invalid origin

[ECD5A]

Summary

• return 403 Forbidden for malformed or non-UTF-8 Origin headers when Origin validation is enabled
• add regression coverage for both invalid-header cases

Fixes #1188

Testing

• cargo test -p rmcp --test test_custom_headers origin_validation --features 'client,server,transport-streamable-http-client-reqwest,transport-streamable-http-server' -- --nocapture
• git diff --check
• targeted rustfmt on the two changed files

[ECD5A]

Closing in favor of #1192, which already covers this status-code fix as part of the broader Origin validation change. I missed the overlap before opening this — sorry for the noise.