fix: reject duplicate streamable HTTP initialize requests

[DragonFSKY]

Summary

• Reject duplicate initialize requests that include an active Mcp-Session-Id in the stateful Streamable HTTP transport.
• Keep fresh initialize requests without a session ID working as before.
• Add a focused servlet-level regression test covering initialize -> initialized -> duplicate initialize.

Fixes #962.

Testing

• ./mvnw -pl mcp-test -am -Dtest=HttpServletStreamableServerTransportProviderTests -Dsurefire.failIfNoSpecifiedTests=false test
• ./mvnw -pl mcp-test -am -Dtest=HttpServletStreamableIntegrationTests,HttpServletStreamableServerTransportProviderTests -Dsurefire.failIfNoSpecifiedTests=false test
• ./mvnw -pl mcp-test -am -Pjackson2 -Dtest=HttpServletStreamableServerTransportProviderTests -Dsurefire.failIfNoSpecifiedTests=false test
• ./mvnw -pl mcp-core,mcp-test spring-javaformat:validate
• git diff --check