Echo parsed request id in Streamable HTTP header/session error responses

[anneheartrecord]

Summary

Header-validation and session-gate errors in the stateless Streamable HTTP transport were returning id: null even though the JSON-RPC request body — and its id — had already been parsed.

In StreamableHttpHandler.HandlePostRequestAsync, the body is parsed (ReadJsonRpcMessageAsync) before ValidateMcpHeaders runs, but WriteJsonRpcErrorAsync constructed a JsonRpcError without an Id, so it serialized as null. The same applied to the post-parse session checks in GetOrCreateSessionAsync.

Per JSON-RPC 2.0 §5, a null id is reserved for responses where the request id couldn't be read (parse error / invalid request). The MCP base protocol likewise requires error responses to carry the request's id except when it couldn't be read from a malformed request. Here the id was available, so it should be echoed.

Change

• WriteJsonRpcErrorAsync takes an optional RequestId and sets it on the error.
• A small GetRequestId(JsonRpcMessage?) helper returns the parsed id for messages that carry one, or default (→ null) otherwise.
• Threaded the parsed id into the header-mismatch path and the three post-parse session-gate error paths.
• Pre-parse paths (Accept negotiation, malformed/null body) and the body-less GET/DELETE paths keep id: null, which stays correct.

Tests

Added to HttpHeaderConformanceTests:

• missing Mcp-Name header echoes the numeric request id (the case in the issue)
• header/body name mismatch echoes a string request id
• Mcp-Session-Id rejected under the 2026-07-28 revision echoes the id
• a malformed body still returns id: null (guards against over-correcting)

Verified the three echo tests fail before the change and pass after; the malformed-body test passes in both. Full HttpHeaderConformanceTests and the Streamable HTTP / stateless / July-2026 suites pass (net10.0; net8/net9 runtimes weren't available locally but the logic is framework-independent).

Fixes #1677