centralize role resolution across all MCP tools

**Related PR:** [#3737 — MSRC 31000000666371: MCP `describe_entities` info-disclosure fix + single-role alignment](https://github.com/Azure/data-api-builder/pull/3737)

## Proposed fix

Add a single choke point on `McpAuthorizationHelper` that every MCP tool calls to obtain the caller's role:

```csharp
public static bool TryResolveValidatedRole(
HttpContext httpContext,
IAuthorizationResolver authResolver,
out string? role);
```

Behavior:
- Delegates validation to `IAuthorizationResolver.IsValidRoleContext` (exactly-one non-empty header value + `HttpContext.User.IsInRole(header)`).
- Returns the validated `X-MS-API-ROLE` header value verbatim as the single role for the request.
- Is the only place any MCP code reads `AuthorizationResolver.CLIENT_ROLE_HEADER`.

Then refactor every MCP tool to call it: `DescribeEntitiesTool`, `AggregateRecordsTool`, `CreateRecordTool`, `DeleteRecordTool`, `ExecuteEntityTool`, `ReadRecordsTool`, `UpdateRecordTool`, `DynamicCustomTool`.

## Design

- **Single-role model.** `X-MS-API-ROLE` is one atomic role. No splitting, no unioning. Matches REST, GraphQL, and DAB's existing `ClientRoleHeaderAuthorizationMiddleware`.
- **Resolver-owned inheritance.** Per-entity authorization goes through `IAuthorizationResolver.AreRoleAndOperationDefinedForEntity` / `GetAllowedExposedColumns`, so `anonymous → authenticated → named` inheritance and wildcard `All` expansion are consistent with REST/GraphQL.
- **One header read.** `AuthorizationResolver.CLIENT_ROLE_HEADER` appears in exactly one MCP file after this change.

## Acceptance

- `grep AuthorizationResolver.CLIENT_ROLE_HEADER src/Azure.DataApiBuilder.Mcp/**` returns one match, in `McpAuthorizationHelper`.
- No `.Split(',')` on the role header anywhere in the MCP project.
- All MCP tools use `TryResolveValidatedRole`; existing tests still pass.

## Non-goals

- No resolver behavior changes.
- No config schema changes.
- No new live-database tests.

## Reference

See [PR #3737](https://github.com/Azure/data-api-builder/pull/3737) for the single-role model, the MSRC fix in `DescribeEntitiesTool`, and the `McpAuthorizationHelper.TryResolveAuthorizedRole` alignment this issue builds on.

Đọc McpAuthorizationHelper và tám điểm vào của công cụ MCP đã được nêu tên, sau đó so sánh các thay đổi hiện có về alignment và security trong PR #3737. Xác minh rằng role header chỉ được đọc trong McpAuthorizationHelper, không có mã MCP nào tách nó, mọi công cụ đều sử dụng TryResolveValidatedRole và các bài kiểm thử hiện có đều đạt.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.