Allow disabling enableAllProjectMcpServers via settings input

## Problem

The `setupClaudeCodeSettings` function hardcodes `enableAllProjectMcpServers: true` after merging user-provided settings, overriding any explicit `false` value:

```typescript
// Always set enableAllProjectMcpServers to true
settings.enableAllProjectMcpServers = true;
```

[Permalink](https://github.com/anthropics/claude-code-action/blob/0630ef383a451c46ccac86eb86ee7641e99c4c9a/base-action/src/setup-claude-code-settings.ts#L63-L64)

This means passing `enableAllProjectMcpServers: false` in the `settings` input has no effect:

```yaml
settings: |
{
"enableAllProjectMcpServers": false
}
```

## Use Case

Our repo has a `.mcp.json` that configures MCP servers for local development. These use absolute local paths and require AWS credentials that aren't available in CI. When the action loads them, Claude tries to use those tools, they aren't in `allowedTools`, and we get permission denials on every run.

We'd like to disable project MCP servers for our PR review workflow since the reviewer only needs the GitHub MCP servers the action provides.

## Suggested Fix

Respect the user's explicit setting — only default to `true` if the user hasn't specified a value:

```typescript
if (settings.enableAllProjectMcpServers === undefined) {
settings.enableAllProjectMcpServers = true;
}
```

Start in base-action/src/setup-claude-code-settings.ts at setupClaudeCodeSettings and inspect how user-provided settings are merged before enableAllProjectMcpServers is assigned. Verify that an explicit false remains false while an omitted value defaults to true, then run the relevant existing test suite or add coverage for both cases.

Written by the indexing model from the issue text.