fix: clean up idle streamable HTTP sessions

[steven-ji]

Add an optional, backward-compatible idle timeout to
HttpServletStreamableServerTransportProvider.

The timeout is disabled by default. When configured, the provider records session
activity and expires only sessions that have remained genuinely idle beyond the
configured timeout. Active requests and open SSE streams keep their sessions alive.

Motivation and Context

Streamable HTTP sessions currently remain in the provider session map until the
client sends an explicit DELETE request or the provider shuts down. Clients can
disconnect, restart, or fail without sending DELETE, causing abandoned sessions
to accumulate indefinitely.

This implements the TTL and recency-marker approach discussed in #471 while
preserving the existing default behavior.

Fixes #471

How Has This Been Tested?

• ./mvnw -pl mcp-core -Dtest=HttpServletStreamableServerSessionTimeoutTests,HttpServletRequestUtilsTests test
  • 17 tests passed
  • 0 failures
  • 0 errors
• ./mvnw -pl mcp-core clean test
  • 394 tests passed
  • 0 failures
  • 0 errors
• ./mvnw -pl mcp-test -am -Dtest=HttpServletStreamableIntegrationTests -Dsurefire.failIfNoSpecifiedTests=false test
  • 43 tests passed
  • 0 failures
  • 0 errors
• git diff --check origin/main...HEAD

The focused timeout tests cover:

• cleanup disabled by default
• invalid timeout validation
• idle session expiration
• GET SSE stream activity
• replay GET activity
• context extraction failure
• POST activity refresh
• in-progress POST protection

The branch was synchronized with the latest main, preserving the upstream
requestMaxSize behavior and its HTTP 413 handling alongside session cleanup.
No successful full-reactor test result is claimed.

Breaking Changes

None. Idle cleanup remains disabled unless sessionTimeout is explicitly
configured, and existing builder usage retains its previous behavior.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

• The implementation is limited to the servlet Streamable HTTP transport.
• External session storage and a global maxSessions limit are outside this PR.
• disclosure.txt is included as required by the repository contribution policy.

[steven-ji]

Hi maintainers — a gentle follow-up on this PR. The branch has been synchronized with the current main, and the focused and module-level validation results are documented in the PR description. The CI and Conformance Tests workflows are still awaiting approval for this fork, with no jobs started. When convenient, could you please approve the workflows and take a look at the change? Thank you.

[steven-ji]

I saw that #471 was closed in favor of #1022. #1022 and #1028 focus on evicting sessions after repeated keep-alive ping failures, and #1028 explicitly leaves a general session TTL out of scope.

This PR covers a separate fallback: an optional idle TTL, disabled by default, that can also clean up abandoned sessions when keep-alive is not configured, while protecting active requests and open SSE streams.

Would you like the idle TTL capability to remain as a separate follow-up after #1028, or should I close this PR in favor of the keep-alive-based approach? I will avoid rebasing or making further changes until the intended scope is clear.