mcp: add max body size limit for SSE + streamable HTTP

[TheodorNEngoy]

This adds a basic DoS guard for the built-in HTTP transports by limiting POST request body size.

• Adds MaxBodyBytes to SSEOptions and StreamableHTTPOptions (default: DefaultMaxBodyBytes = 1_000_000; negative disables).
• Adds MaxBodyBytes to SSEServerTransport and StreamableServerTransport for custom handler usage.
• Returns 413 Request Entity Too Large when the limit is exceeded.
• Includes tests covering both SSE and streamable handlers/transports.

Rationale: avoid unbounded io.ReadAll(req.Body) buffering for network-exposed servers.

[TheodorNEngoy]

Local sanity check: go test ./... passes on this branch.