mcp: add max body size limit for SSE + streamable HTTP

[TheodorNEngoy]

This adds a basic DoS guard for the built-in HTTP transports by limiting POST request body size.

• Adds MaxBodyBytes to SSEOptions and StreamableHTTPOptions (default: DefaultMaxBodyBytes = 1_000_000; negative disables).
• Adds MaxBodyBytes to SSEServerTransport and StreamableServerTransport for custom handler usage.
• Returns 413 Request Entity Too Large when the limit is exceeded.
• Includes tests covering both SSE and streamable handlers/transports.

Rationale: avoid unbounded io.ReadAll(req.Body) buffering for network-exposed servers.

[TheodorNEngoy]

Local sanity check: go test ./... passes on this branch.

[maciej-kisiel]

Adding a default for this limit is a backwards incompatible behavior change, which we generally try to avoid. Isn't this already easy enough to achieve by wrapping the MCP HTTP Handler with https://godoc.corp.google.com/pkg/net/http#MaxBytesHandler?