fix: validate and forward SEP-2243 parameter headers

[lucarlig]

Summary

• validate modern tools/call Mcp-Param-* headers against request-scoped tool schemas published by the control plane
• return HTTP 400 / JSON-RPC -32020 for a mismatch or missing published schema
• forward validated parameter headers unchanged on the outgoing tools/call and protect them from backend header configuration
• keep plugin handling unchanged: plugins run after validation and do not cause header reconstruction

The dataplane does not call tools/list, reconstruct headers from arguments, or change RMCP. This PR requires IBM/mcp-context-forge#6348 to publish visibility-filtered schemas keyed by original upstream tool name.

The GitHub composed conformance job still pulls the stock control-plane image and therefore fails to deserialize its pre-#6348 payload (missing field tool_schemas). No dataplane fallback is included; the job will pass once #6348 is merged into that image.

Stacked on #107. Related: IBM/mcp-context-forge#6256.

Verification

• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo nextest run --locked --workspace (227 passed, 3 skipped)
• workspace build, dependency-policy, shear, formatting, generated-schema, and wiki checks
• conformance adapter, reporter, and baseline unit tests
• control-plane publisher unit tests (26 passed), Ruff, and Black
• cross-repo E2E with the official conformance fixture and #6348 publisher: matching plain/Base64 values pass; mismatched, invalid Base64, and missing headers return 400/-32020

The direct fixture E2E is used because the official server scenario currently reaches the separately baselined stateless tools/list session limitation during setup. Client findings remain limited to the existing four shell-adapter generation IDs.