MCPTool: No way to pass dynamic bearer tokens for MCP server authentication

## Description

When using `MCPTool` from `azure-ai-projects` to connect to an MCP server that requires bearer token authentication, there's no viable way to pass dynamic tokens that are generated at runtime.

## Current Behavior

Passing an `Authorization` header directly to `MCPTool` results in:

```
HttpResponseError: (invalid_payload) Headers that can include sensitive information are not allowed in the headers property for MCP tools. Use project_connection_id instead.
```

## Problem

The suggested alternative `project_connection_id` references a pre-configured connection in the Azure AI Foundry project. However, this approach doesn't work for scenarios where:

1. Bearer tokens are generated dynamically at runtime
2. Tokens have short expiration times and need to be refreshed frequently
3. The authentication flow is handled by the client application, not by Azure

## Expected Behavior

There should be a way to pass dynamic authentication headers to MCP servers, such as:

1. Allow sensitive headers when explicitly opted-in (e.g., `allow_sensitive_headers=True`)
2. Support a callback/function that provides the token at request time
3. Support inline token refresh mechanisms

## Code Example

```python
from azure.ai.projects.models import MCPTool

# This fails with the error above
mcp_tool = MCPTool(
server_label="custom-mcp",
server_url="https://example.com/api/mcp",
require_approval="never",
headers={"Authorization": f"Bearer {dynamic_token}"},
)
```

## Environment

- Package: `azure-ai-projects>=2.0.0b1`
- Python: 3.x

## Additional Context

This limitation prevents using `MCPTool` with any MCP server that requires client-generated bearer tokens for authentication.

Commencez par l’utilisation de MCPTool et le comportement de validation de sensitive-header décrits dans l’issue, puis suivez la manière dont headers et project_connection_id sont traités. C’est terminé lorsque MCP servers peuvent recevoir des bearer tokens générés par le client qui peuvent être actualisés à l’exécution sans exposer de sensitive headers non pris en charge.

Rédigé par le modèle d'indexation à partir du texte de l'issue.