Fix small bug with handling empty principal id

• Expose a property on the Session Preflight endpoint which lets you explicitly select whether to incorporate the principal id. The high level is the SSE should essentially never use principals, Streamable HTTP can.

Given SSE SessionIds no longer include principal id, this removes the verification from the SSE transport message endpoint.

Updated the SSE handler to not expect auth information

Major Change to SessionId Handling

This change introduces a session manager, but more importantly creates a flow where implementations can either:

1. Have sessionIds persisted as cookies to clients. This is useful for clients like VS Code and Goose
2. Run a preflight where a secure session id is generated, and that is handed to the backend through a query parameter.

This also introduced secure session ids where a signature is embedded on the sessionId.

Fixed a small issue where one way messages (notifications/initialize in particular) was getting a 204 instead of a 202

Fix a bug where we were accidentally sending the endpoint message on MCP sse connections

Fixed a bug where list methods would return null instead of empty, fixed handling of notifications/canceled (though, I'm not actually handling it, it's a no-op, which probably isn't right)

Fixed a nasty bug where a client connecting with a new MCP version would get a hard failure rather than a downgraded version.

Major update as we're driving for a v1 release!

• Changed the Static Tool Registry to support generics and annotations on input / output params. Please review the minimal server example, it's a very simple model
• Updated to go-akt v3.6.6, lots of update