fix: explain transport host rejections

[he-yufeng]

Summary

• keep the existing fail-closed Host validation behavior
• return a structured HTTP 421 body that names host_not_allowed, the received Host value, and the TransportSecuritySettings.allowed_hosts setting
• document reverse-proxy allowed_hosts configuration with host and host:port examples

Fixes #2688.

To verify

• uv run pytest tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py -q
• uv run ruff check src/mcp/server/transport_security.py tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py
• uv run pyright src/mcp/server/transport_security.py tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py
• git diff --check

[he-yufeng]

Rebased this branch on current main and force-pushed b737756.

The conflicts were in the SSE and Streamable HTTP security tests because upstream moved these checks to in-process ASGI clients. I kept that newer test structure and re-applied this PR's structured host rejection assertions on top.

Validated locally:

• uv run --frozen pytest tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py::test_origin_validation_rejects_disallowed_origins_when_enabled -q (49 passed)
• uv run --frozen ruff check src/mcp/server/transport_security.py tests/interaction/transports/test_hosting_http.py tests/server/test_transport_security.py tests/server/test_sse_security.py tests/server/test_streamable_http_security.py
• uv run --frozen ruff format --check src/mcp/server/transport_security.py tests/interaction/transports/test_hosting_http.py tests/server/test_transport_security.py tests/server/test_sse_security.py tests/server/test_streamable_http_security.py
• uv run --frozen pyright src/mcp/server/transport_security.py tests/interaction/transports/test_hosting_http.py tests/server/test_transport_security.py tests/server/test_sse_security.py tests/server/test_streamable_http_security.py (0 errors)
• python -m py_compile src\mcp\server\transport_security.py tests\interaction\transports\test_hosting_http.py tests\server\test_transport_security.py tests\server\test_sse_security.py tests\server\test_streamable_http_security.py
• git diff --check --cached before completing the rebase