fix(mcp): enforce read-only policy and session scope on plugin tool dispatch

[jinpy666]

Problem

The plugin-tool surface introduced by the flat/lazy meta tools is gated by the flat tool allowlist, but it skips the rest of the execution policy stack that every native dbx_* tool enforces:

• Under a read-only execution policy, plugin tools still run. Plugin-provided annotations.readOnlyHint is displayed (tools/list) but never enforced, so a tool such as dbx_kafka__kafka_topics_delete executes writes in a deployment the operator configured as read-only.
• In a scoped session (DBX_MCP_SCOPE_*), the flat tools/list filters out plugins without in-scope connections, but the lazy/meta surface still lets callers enumerate every installed plugin (dbx_plugin_list, dbx_plugin_tools with full argument schemas) and call their connection-less tools.
• dbx_plugin_tools answers "all tools hidden" differently from "plugin does not exist", which lets a client fingerprint installed plugin ids.

Fix

• New shared ensure_plugin_tool_policy check on both call paths (dbx_<prefix>__<tool> dispatch and dbx_plugin_call), before the backend is reached:
  • under read_only, reject tools the plugin does not declare readOnlyHint with MCP_READ_ONLY;
  • with a scope active, reject plugins that own no in-scope connection with PLUGIN_OUT_OF_SCOPE.
• dbx_plugin_list/catalog skip scope-hidden plugins entirely (no row, no hidden-count disclosure); dbx_plugin_tools answers a scoped-out plugin with the same out-of-scope error and no tool schema.
• dbx_plugin_tools now answers a nonexistent plugin and an all-allowlist-hidden one identically.

Credentials stay bound to the owning plugin as before; this only closes the policy gap.

Testing

• plugin_tools_enforce_read_only_policy: undeclared write rejected on both dispatch paths, backend never reached; declared read-only tool still runs.
• plugin_tools_enforce_session_scope: out-of-scope plugin rejected, disappears from dbx_plugin_list/dbx_plugin_tools, in-scope plugin keeps working.
• plugin_tool_wildcards_match_only_the_plugin_namespace (companion PR) and the existing allowlist tests still pass; full cargo test -p dbx-mcp --lib (186 tests) green on my fork's CI run of the equivalent branch.

[t8y2]

Thanks for the contribution! Merged in 1b6b003, will be released in the next version.