feat: add ToolAuthorizationMiddleware for granular tool access control

[Matovidlo]

Description

Link to Devin run: https://app.devin.ai/sessions/11342fe981114dcbb8980e63517d132a
Requested by: Martin Vasko (@Matovidlo)

Change Type

• Major (breaking changes, significant new features)
• Minor (new features, enhancements, backward compatible)
• Patch (bug fixes, small improvements, no new features)

Summary

Adds a new ToolAuthorizationMiddleware that enables granular tool access control via HTTP headers. This allows administrators to restrict which tools specific clients (like Devin AI agent) can access.

New HTTP Headers:

• X-Allowed-Tools: Comma-separated list of allowed tool names (e.g., get_configs,get_buckets,query_data)
• X-Read-Only-Mode: Set to true/1/yes to restrict access to read-only tools only

Behavior:

• When no headers are present, all tools are available (backward compatible)
• When both headers are present, the intersection is used (tool must be in allowed list AND be read-only)
• Empty X-Allowed-Tools header is treated as no restriction (same as no header)

Key files:

• src/keboola_mcp_server/authorization.py - New middleware implementation with READ_ONLY_TOOLS frozenset
• src/keboola_mcp_server/server.py - Middleware registration in the pipeline
• tests/test_authorization.py - Comprehensive unit tests (27 test cases)

Human Review Checklist

• Verify READ_ONLY_TOOLS list matches all tools with readOnlyHint=True annotation
• Confirm middleware ordering (after SessionStateMiddleware, before ToolsFilteringMiddleware) is correct
• Review empty header behavior - currently treated as "no restriction"
• Note: ctx parameter in _get_allowed_tools is unused (only uses get_http_request_or_none())

Testing

• Tested with Cursor AI desktop (Streamable-HTTP transports)

Optional testing

• Tested with Cursor AI desktop (all transports)
• Tested with claude.ai web and canary-orion MCP (SSE and Streamable-HTTP)
• Tested with In Platform Agent on canary-orion
• Tested with RO chat on canary-orion

Checklist

• Self-review completed
• Unit tests added/updated (if applicable)
• Integration tests added/updated (if applicable)
• Project version bumped according to the change type (if applicable)
• Documentation updated (if applicable)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring