Return HTTP 403 when Origin header is invalid

[Kehrlann]

This tracks modelcontextprotocol/modelcontextprotocol#1439

See also: #284

[Kehrlann]

Python implementation: modelcontextprotocol/python-sdk#861
Typescript implementation: https://github.com/modelcontextprotocol/typescript-sdk/pull/565/changes

Note: they also validate the host, not only the origin.