#2726 fix: explain transport host rejections

Summary

• keep the existing fail-closed Host validation behavior
• return a structured HTTP 421 body that names host_not_allowed, the received Host value, and the TransportSecuritySettings.allowed_hosts setting
• document reverse-proxy allowed_hosts configuration with host and host:port examples

Fixes #2688.

To verify

• uv run pytest tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py -q
• uv run ruff check src/mcp/server/transport_security.py tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py
• uv run pyright src/mcp/server/transport_security.py tests/server/test_transport_security.py tests/server/test_streamable_http_security.py tests/server/test_sse_security.py tests/interaction/transports/test_hosting_http.py
• git diff --check