add basic sessionid support

[ashleyhindle]

What & Why

Adds basic session support to allow a non-authed MCP connection to have some level of persistence.

This PR generates a session id on 'initialize', then makes it available in the Mcp\Request class, so each primitive can access it via: $request->sessionId()

Docs: https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management

Most important parts of the docs for this = server can set a session id, client must send it on every request:

A server using the Streamable HTTP transport MAY assign a session ID at initialization time, by including it in an Mcp-Session-Id header on the HTTP response containing the InitializeResult

If an Mcp-Session-Id is returned by the server during initialization, clients using the Streamable HTTP transport MUST include it in the Mcp-Session-Id header on all of their subsequent HTTP requests.

How I tested

1. Setup an MCP server called Escapa in Claude Code and Cursor
2. Asked for the session id, then checked the session IDs were different
3. Re-asked for the session id, got the same one back - we now have session support.

So now I can store data against that session in my tools/etc.. 👌

Notes/thoughts

Now

• I don't like passing sessionId as part of the transport. It's only supported via the HttpTransport really, but I didn't want to 'undo' it from other transports.
• I'm 100% confident that 'session' is part of the generic MCP Request though

Future

• In future we should add a Session object like HTTP, with differently backed sessions, but this is useful enough for now.
• This would allow us to have 'session context/data' like we do on the web, but probably need to generate more secure session IDs

Demo