fix: clean up idle streamable HTTP sessions

[steven-ji]

Add an optional, backward-compatible idle timeout to
HttpServletStreamableServerTransportProvider.

The timeout is disabled by default. When configured, the provider records session
activity and expires only sessions that have remained genuinely idle beyond the
configured timeout. Active requests and open SSE streams keep their sessions alive.

Motivation and Context

Streamable HTTP sessions currently remain in the provider session map until the
client sends an explicit DELETE request or the provider shuts down. Clients can
disconnect, restart, or fail without sending DELETE, causing abandoned sessions
to accumulate indefinitely.

This implements the TTL and recency-marker approach discussed in #471 while
preserving the existing default behavior.

Fixes #471

How Has This Been Tested?

• ./mvnw -pl mcp-core clean test
  • 364 tests passed
  • 0 failures
  • 0 errors
• git diff --check origin/main...HEAD
• Added 9 focused tests covering:
  • cleanup disabled by default
  • invalid timeout validation
  • idle session expiration
  • GET SSE stream activity
  • replay GET activity
  • context extraction failure
  • POST activity refresh
  • in-progress POST protection

The validation claim is limited to the mcp-core module; no successful
full-reactor test result is claimed.

Breaking Changes

None. Idle cleanup remains disabled unless sessionTimeout is explicitly
configured, and existing builder usage retains its previous behavior.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• The implementation is limited to the servlet Streamable HTTP transport.
• External session storage and a global maxSessions limit are outside this PR.
• disclosure.txt is included as required by the repository contribution policy.