Reject mismatched initialize protocol versions

[halter73]

Fixes #1580.

Rejects Streamable HTTP initialize requests when MCP-Protocol-Version disagrees with params.protocolVersion. The handler returns HTTP 400 with HeaderMismatch and preserves the parsed JSON-RPC request ID.

Adds coverage for both mismatch directions in stateful and stateless modes.

[Copilot]

Pull request overview

This PR addresses #1580 by enforcing consistency between the Streamable HTTP MCP-Protocol-Version header and the initialize.params.protocolVersion value in the JSON-RPC body. When the two disagree, the server now rejects the request with HTTP 400 using the HeaderMismatch error code while echoing the parsed JSON-RPC request ID, and adds regression coverage for both mismatch directions in both stateful and stateless profiles.

Changes:

• Add an initialize-specific protocol version consistency check (header vs. params.protocolVersion) in the Streamable HTTP handler.
• Preserve JSON-RPC request ID when returning HeaderMismatch for this new validation failure.
• Add integration tests covering both mismatch directions across stateful/stateless modes.

Show a summary per file

File	Description
tests/ModelContextProtocol.AspNetCore.Tests/StreamableHttpServerConformanceTests.cs	Adds regression tests asserting HTTP 400 + HeaderMismatch and that the JSON-RPC id is preserved when header/body versions disagree on initialize.
src/ModelContextProtocol.AspNetCore/StreamableHttpHandler.cs	Implements header/body protocol version mismatch rejection for initialize requests via ValidateProtocolVersionEnvelope.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Low

[tarekgh]

LGTM!