Refactor HttpClient-based transports to Publisher-based approach

[Kehrlann]

Refactor HttpClient use to avoid capturing the sseSink that leads to leaking the httpClient reference due to a cycle (see #620).
This rewrites the HttpClient streaming support from a BodySubscriber pushing messages to a Publisher-based approach.

This avoids the HttpClient cyclic reference we had in the previous implementation. The tradeoff is that we have to perform line parsing manually with a Utf8LineDecoder we maintain.
We can batch this rework with performance fixes reading large SSE events (see #1042)

Fixes #1042
Fixes #620

(Rebased @chemicL 's work on issue #620)

[chemicL]

I re-visited this PR @Kehrlann with some commits. Thank you for refreshing it and integrating it with the recent changes!

Here's a summary of what is addressed here altogether:

Reliability

• Closed transports no longer keep their HttpClient alive, so selector threads and memory stop piling up. Fixes HttpClient resource leak causes thread accumulation and memory exhaustion #620; supersedes fix: release transport-owned HttpClient references on close #904 and the leak part of fix: resolve resource leaks in transport session and httpclient #868.
• closeGracefully() now releases open connections even when the session DELETE fails, e.g. when the server is down. Fixes DefaultMcpTransportSession#closeGracefully leaks resources on incomplete DELETE response #547; overlaps fix(session): always dispose in closeGracefully #566 and fix: resolve resource leaks in transport session and httpclient #868.
• connect() on the legacy SSE transport no longer hangs:
  • it fails when the stream ends or errors before the first event, including a non-2xx response with an empty body;
  • it completes when closeGracefully() is called before the first event.
• sendMessage() on Streamable HTTP no longer hangs:
  • it completes when the server closes an SSE response without sending any events;
  • it completes when the transport is closed before the response arrives.
• Responses the client never reads are always released, so connections go back to the pool.

Errors surface immediately instead of as timeouts

• On Streamable HTTP, a JSON response that can't be read (malformed, or over maxResponseSize) now fails the request immediately with the real cause, instead of a TimeoutException after requestTimeout. Fixes Streamable HTTP: invalid JSON response is reported as a timeout #1147; partially addresses Propagate body-level errors as synthetic JSON-RPC responses #896.
• A server that answers a request with an empty JSON body now makes that request fail instead of silently timing out. An empty body in reply to a notification is still tolerated.
• Server-caused errors are now McpTransportException instead of a plain RuntimeException, and the message includes the response body the server sent.
• Errors that happen after connect() or sendMessage() has already completed now reach the transport's exception handler instead of Reactor "onErrorDropped" logs.
• A 404 or 400 invalidates the session only if the request that got it carried a session id.

Performance

• Large SSE responses, such as multi-MB tool results, are no longer slow to receive. Fixes Streamable HTTP client: slow reception of large SSE tool responses (fromLineSubscriber line-assembly bottleneck) #1042; supersedes fix(client): improve performance of large SSE tool responses #1052.

SSE parsing (now follows the spec)

• Unknown fields such as retry: are ignored instead of failing the stream with "Invalid SSE response". Fixes the error part of SSE client rejects valid retry: field and ignores reconnection timing (Streamable HTTP) #1047; retry: timing is still not honoured. Supersedes fix(client): ignore unknown SSE fields instead of erroring the stream #1051 and fix: ignore SSE retry: field to prevent McpTransportException #1082.
• The event type resets after each event, so a message that follows a named event is no longer misclassified and dropped. Supersedes fix: reset SSE event type and id buffers after dispatch #1094.
• A data: line containing U+2028, U+2029 or U+0085 is no longer truncated. Fixes SSE client silently truncates a data: line at U+2028/U+2029/U+0085, then fails with "Error parsing JSON-RPC message" #1136.
• The legacy SSE transport skips empty "primer" events and unknown event types instead of failing.
• An empty id: clears the last event id.

Memory safety

• Discarded response bodies are now capped at maxResponseSize in total. Before, only each line was capped, so a server could keep the client reading a never-ending discarded body. The per-message limit on SSE events and JSON responses is unchanged.

API

• No public API changes.

[chemicL]

the Mono.create dance combined with sink.onCancel, combined with exchange.whenComplete is caused by an issue with reactor-core's handling of HttpClient's CancellationException wrapping inside a CompletionException: reactor/reactor-core#4415