Add collision-resistant request and operation IDs for MCP handling

[davidahmann]

Problem

Request/operation correlation IDs are not guaranteed to exist or be collision-resistant across MCP middleware/server handling paths, which weakens observability and audit correlation.

Why now

Issue #2099 requests stable, collision-resistant request/operation IDs for tool invocation flow.

What changed

• Added request/operation ID context helpers with cryptographically random ID generation.
• Added request ID propagation in HTTP request config middleware using X-Request-ID (preserve-or-generate behavior).
• Added server middleware to ensure operation IDs are generated per request and bound to context.
• Added tests for request ID propagation and operation ID generation behavior.

Validation

• go test ./pkg/http/middleware ./pkg/github -run 'TestWithRequestConfig|TestWithOperationID' (pass)

Refs #2099

[davidahmann]

Implemented request/operation ID generation and propagation middleware for MCP flows plus tests verifying preserve-or-generate request IDs and unique operation IDs.

This contribution was informed by patterns from Wrkr. Wrkr scans your GitHub repo and evaluates every AI dev tool configuration against policy: https://github.com/Clyra-AI/wrkr