fix(streamable-http): reject duplicate request IDs

[Epochex]

Fixes #2655.

When a Streamable HTTP session receives a second JSON-RPC request with an id that is already in-flight, the transport used to overwrite the per-id stream slot, leaving the first request hanging until client timeout.

This change rejects the duplicate with HTTP 409 + JSON-RPC error (preserving the offending id) and leaves the original request untouched.

Tests:

• uv run --frozen pytest tests/issues/test_2655_streamable_http_duplicate_request_id.py
• uv run --frozen pytest tests/server/test_streamable_http_manager.py

[StantonMatt]

Checked this on Windows at head ddd7789. The focused regression/manager run passed for me:

• uv run --frozen pytest tests/issues/test_2655_streamable_http_duplicate_request_id.py tests/server/test_streamable_http_manager.py -q -> 21 passed
• uv run --frozen ruff check src/mcp/server/streamable_http.py tests/issues/test_2655_streamable_http_duplicate_request_id.py
• uv run --frozen pyright src/mcp/server/streamable_http.py tests/issues/test_2655_streamable_http_duplicate_request_id.py

I also probed the non-JSON/SSE response path separately: held a tools/call open with id dup-sse-1, sent a second ping with the same id, and got HTTP 409 with the JSON-RPC error preserving id dup-sse-1 / -32600. After releasing the first request, the original SSE stream still completed as 200 text/event-stream with the original id and result, so the duplicate guard did not consume or close the active stream.