feat: add McpSessionStore SPI for pluggable session storage

[vlin529]

Summary

Introduce a McpSessionStore interface that abstracts session storage in HttpServletStreamableServerTransportProvider, enabling custom implementations (e.g., Redis, JDBC, Hazelcast) for distributed and multi-instance MCP server deployments.

Problem

Currently, HttpServletStreamableServerTransportProvider stores sessions in a hardcoded ConcurrentHashMap. This causes:

• Sessions lost on restart — clients get "Session not found" errors after server restart
• No multi-instance support — sessions created on Pod A are invisible to Pod B behind a load balancer
• No extension point — the sessions field is private final, methods are private, Builder has no sessionStore() option

Related issues: #274, #107, #738, #376

Changes

• McpSessionStore — new interface with save/get/remove/values/isEmpty/size/clear operations
• InMemoryMcpSessionStore — default ConcurrentHashMap-backed implementation (preserves existing behavior)
• HttpServletStreamableServerTransportProvider — refactored to use McpSessionStore instead of hardcoded ConcurrentHashMap
• Builder — added sessionStore(McpSessionStore) method for custom store injection; defaults to InMemoryMcpSessionStore when not set

Usage

// Default (backward compatible — no changes needed)
HttpServletStreamableServerTransportProvider.builder()
    .jsonMapper(mapper)
    .build();

// Custom Redis-backed store
HttpServletStreamableServerTransportProvider.builder()
    .jsonMapper(mapper)
    .sessionStore(new RedisSessionStore(redisTemplate))
    .build();

Non-breaking

This is a fully backward-compatible change. Existing code continues to work without modification — the default InMemoryMcpSessionStore is used when no custom store is provided.

Test

All 274 existing mcp-core tests pass.

---

Note: This PR only addresses HttpServletStreamableServerTransportProvider in mcp-core. The same pattern should be applied to the Spring WebMvc/WebFlux transport providers as a follow-up.

Closes #274
Relates to #107, #738, #376