fix: await in-flight handlers before disposing to prevent ObjectDisposedException

[jongio]

Summary

Fixes a race condition in stateless HTTP mode where ObjectDisposedException is thrown when an HTTP connection is aborted while tool handlers are still executing.

Closes #1269

Problem

In stateless mode, McpSessionHandler.ProcessMessagesCoreAsync fires and forgets message handler tasks (_ = ProcessMessageAsync()). When the HTTP connection is aborted (e.g., client timeout), the disposal chain runs:

1. context.RequestAborted fires
2. Session transport is disposed, completing the message channel
3. ProcessMessagesCoreAsync exits the foreach loop
4. Session and server are disposed
5. ASP.NET Core disposes context.RequestServices (the HTTP request scope)

But in step 3, fire-and-forget handler tasks may still be running. When they try to access scoped services (like DbContext or ILogger), ObjectDisposedException is thrown because the request scope was disposed in step 5.

Fix

Track handler tasks in ProcessMessagesCoreAsync and await them in the finally block before allowing the method to return. Since ProcessMessagesCoreAsync is awaited indirectly by the HTTP request handler (via ServerRunTask), this keeps the request scope alive until all handlers complete:

• Handler tasks are captured in a List<Task> instead of being discarded
• The finally block calls Task.WhenAll(pendingHandlers) before failing pending requests
• Exceptions from handlers are already logged individually in ProcessMessageAsync, so they are caught and suppressed in WhenAll

This is a minimal change to the core message processing loop that fixes the issue without changing the service provider or scope configuration.

Testing

• Added regression test ScopedServices_AccessibleInToolHandler_AfterConnectionAbort that:
  • Registers a tool handler that blocks, waits for the connection to abort, then accesses scoped services
  • Verifies the scoped service is accessible without ObjectDisposedException after connection abort
  • Uses a side-channel (TaskCompletionSource) to verify handler outcome since the client call is aborted
• All existing StatelessServerTests continue to pass
• Full test suite: 303 passed, 11 skipped, 2 pre-existing conformance failures