Adds opt-in 'enableMcpApps' session capability that advertises the
'extensions.io.modelcontextprotocol/ui' extension to MCP servers and
exposes 'session.rpc.mcp.apps.*' JSON-RPC methods.

Node SDK gains two pure helpers for hosts rendering 'ui://' MCP App
bundles in iframes:

- buildMcpAppsCspHeader — constructs the Content-Security-Policy header
  per SEP-1865 §UI Resource Format + §Security Implications, including
  the restrictive default ('connect-src none') when '_meta.ui.csp' is
  absent and constructed defaults ('connect-src self', etc.) when it is
  declared.
- buildMcpAppsAllowAttribute — maps '_meta.ui.permissions' to the iframe
  'allow' attribute (Permission Policy).

Co-authored-by: Copilot <[email protected]>

Mirror nodejs enableMcpApps across the other four SDKs so hosts using
them can opt into MCP Apps (SEP-1865) UI passthrough by sending
requestMcpApps on session.create / session.resume.

- python: enable_mcp_apps kwarg on create_session / resume_session
- go: EnableMcpApps field on SessionConfig / ResumeSessionConfig
- dotnet: EnableMcpApps property on SessionConfig / ResumeSessionConfig
- rust: request_mcp_apps field + with_request_mcp_apps builder

Co-authored-by: Copilot <[email protected]>

Port the CSP directive injection defense from copilot-agent-runtime PR
#7605 into the SDK. Without sanitization, an MCP server returning
`frameDomains: ['evil.com; form-action *']` could break out of one CSP
directive and inject sibling directives (CSP first-occurrence rule then
lets an earlier injected `script-src *` win).

Each server-supplied entry is now:
- rejected if it contains CSP metacharacters ([;,\\s'"\\\\])
- accepted verbatim for the bare-scheme allowlist (data:, blob:,
  mediastream:, filesystem:)
- otherwise parsed via URL and canonicalized to its origin; opaque
  origins (where `URL.origin` is the literal string 'null') are dropped

Adds 10 sanitization tests mirroring runtime PR coverage.

Co-authored-by: Copilot <[email protected]>

Expose the runtime's response capability so consumers can detect when
their enableMcpApps opt-in was silently dropped by the runtime gate
(MCP_APPS feature flag / COPILOT_MCP_APPS env override unset).

For each SDK:
- Add mcpApps?: bool to the SessionUiCapabilities type
- After session.create / session.resume, if the consumer requested the
  opt-in but capabilities.ui.mcpApps is not true on the response, log
  a warning (console.warn / logger.warning / slog / tracing::warn /
  fmt.Fprintf(os.Stderr, ...)) so the silent drop is discoverable.

Co-authored-by: Copilot <[email protected]>

- python: ruff format reflowed the new _warn_if_mcp_apps_dropped helper
- rust: tests/e2e/elicitation.rs constructs UiCapabilities as a struct
  literal; the new mcp_apps field made it non-exhaustive

Co-authored-by: Copilot <[email protected]>

…t-logging

CodeQL flags any value flowing from process.env as sensitive via taint
analysis (joinSession() reads process.env.SESSION_ID which propagates to
resumeSession's sessionId argument). The session ID is a UUID and not
actually sensitive, but the alert noise is not worth it -- the warning
is per-call so the consumer already knows which session triggered it.

Co-authored-by: Copilot <[email protected]>

# Conflicts:
#	dotnet/src/Types.cs

Co-authored-by: mattdholloway <[email protected]>

Co-authored-by: Copilot <[email protected]>

- Fix broken @link in Java SessionConfig (com.github.copilot.sdk.CopilotSession -> com.github.copilot.CopilotSession)

- Revert stray mode change on .githooks/pre-commit (100755 -> 100644)

- Rust: make enable_mcp_apps Option<bool> for consistency with sibling opt-ins (e.g. enable_config_discovery)

- Python: remove stray blank line after logger init in client.py

- Drop incorrect 'the SDK also logs a warning' wording from Python docstrings (the SDK no longer emits a warning; only the runtime does)

Co-authored-by: Copilot <[email protected]>

Co-authored-by: Copilot <[email protected]>