feat(security): add subdomain wildcard support to allowed_hosts and allowed_origins

[Zelys-DFKH]

Closes #2141.

TransportSecuritySettings previously supported two matching modes for allowed_hosts and allowed_origins:

• Exact: "example.com"
• Port wildcard: "example.com:*"

This adds subdomain wildcards:

• "*.example.com" in allowed_hosts — matches example.com and any of its subdomains; port is stripped before matching
• "https://*.example.com" in allowed_origins — same, but scheme must also match

Behavior follows Django's ALLOWED_HOSTS and Starlette's TrustedHostMiddleware: *.example.com covers the base domain too, so no separate entry for example.com is needed.

Also fixes a coverage gap: _validate_host, _validate_origin, and the DNS-rebinding path in validate_request were all # pragma: no cover. Those paths were only exercised by subprocess-based integration tests, which coverage never sees. This PR adds direct unit tests for TransportSecurityMiddleware (28 tests, 100% branch coverage) and removes all the no-cover markers.

Files changed:

• src/mcp/server/transport_security.py
• tests/server/test_transport_security.py (new)