MCPTool: No way to pass dynamic bearer tokens for MCP server authentication

## Description

When using `MCPTool` from `azure-ai-projects` to connect to an MCP server that requires bearer token authentication, there's no viable way to pass dynamic tokens that are generated at runtime.

## Current Behavior

Passing an `Authorization` header directly to `MCPTool` results in:

```
HttpResponseError: (invalid_payload) Headers that can include sensitive information are not allowed in the headers property for MCP tools. Use project_connection_id instead.
```

## Problem

The suggested alternative `project_connection_id` references a pre-configured connection in the Azure AI Foundry project. However, this approach doesn't work for scenarios where:

1. Bearer tokens are generated dynamically at runtime
2. Tokens have short expiration times and need to be refreshed frequently
3. The authentication flow is handled by the client application, not by Azure

## Expected Behavior

There should be a way to pass dynamic authentication headers to MCP servers, such as:

1. Allow sensitive headers when explicitly opted-in (e.g., `allow_sensitive_headers=True`)
2. Support a callback/function that provides the token at request time
3. Support inline token refresh mechanisms

## Code Example

```python
from azure.ai.projects.models import MCPTool

# This fails with the error above
mcp_tool = MCPTool(
server_label="custom-mcp",
server_url="https://example.com/api/mcp",
require_approval="never",
headers={"Authorization": f"Bearer {dynamic_token}"},
)
```

## Environment

- Package: `azure-ai-projects>=2.0.0b1`
- Python: 3.x

## Additional Context

This limitation prevents using `MCPTool` with any MCP server that requires client-generated bearer tokens for authentication.

まず、issue に記載された MCPTool の使用方法と sensitive-header の検証動作から始め、次に headers と project_connection_id がどのように扱われるかを追跡します。完了条件は、MCP servers がクライアント生成の bearer tokens を受け取り、それらを実行時に更新でき、サポートされていない sensitive headers を公開しないことです。

索引モデルが issue の本文から書いたものです。