[Server] Add PassthroughMiddleware for the HTTP transport opt-out

[mglaman]

Closes #523

StreamableHttpTransport logs a warning on every request when it gets middleware: []. The constructor docblock and docs/run/http.md still describe [] as the way to drop the defaults, and the guide recommends it when the host application already handles CORS and host validation.

This PR ships the opt-out suggested in #523 as PassthroughMiddleware, a middleware that only calls $handler->handle($request):

$transport = new StreamableHttpTransport(
    $request,
    middleware: [new PassthroughMiddleware()],
);

• PassthroughMiddleware in Mcp\Server\Transport\Http\Middleware.
• The empty-list warning names it as the opt-out. It also no longer lists "protocol version validation" as disabled: since 0.8 the transport applies handshakeMiddleware() to handshake-era requests regardless of the custom list.
• StreamableHttpTransport::__construct(): the docblock says an empty list logs a warning and points to PassthroughMiddleware.
• docs/run/http.md: the middleware parameter links to a new "Opting Out of All Middleware" section. The "run only your own chain" example passed a non-empty list but told readers to pass [], so I reworded it.

StatelessHttpTransport doesn't warn on an empty list, so it's unchanged.

Tests: testPassthroughMiddlewareDisablesDefaultsWithoutWarning checks that the pass-through logs no warning and that CORS and DNS rebinding are off. The existing empty-list test still matches the new warning text.

Checked locally: transport unit tests pass, php-cs-fixer is clean, phpstan reports only the two existing ElicitationSchema.php errors from main, and zensical build --strict passed on the first commit.

🤖 Generated with Claude Code

[chr-hertel]

Two things we could still do to improve this:

• ship the PassthroughMiddleware
• improve the log message

[mglaman]

Done in 279e78b: shipped PassthroughMiddleware with your spelling, and the warning now points to it.

[chr-hertel]

Thank you @mglaman!