Feature Request: Add --read-only flag for Workers Bindings MCP server

## Feature Request

Add a `--read-only` flag option for the Workers Bindings MCP server to allow users to grant only read permissions during OAuth.

## Use Case

I want to use the MCP server to debug and inspect R2 buckets, D1 databases, and Workers without granting write access. This is important for:
- Security: Prevent accidental modifications from AI agents
- Debugging: Only need to inspect/read data, not modify it

## Example: Supabase MCP

The Supabase MCP server supports this pattern:

```bash
npx -y @supabase/mcp-server-supabase@latest --read-only --project-ref=

The --read-only flag ensures the MCP server only requests read scopes during authentication.
```

## Requested Change

Add a similar flag for Cloudflare MCP:

npx mcp-remote https://bindings.mcp.cloudflare.com/sse --read-only

Or provide a separate read-only endpoint:

npx mcp-remote https://bindings.mcp.cloudflare.com/sse/read-only

This would only request these OAuth scopes:
- User: Read
- Cloudflare Account: Read
- Cloudflare Workers/R2/D1: Read only (no write)
- Remove "Background Access" for read-only mode

Start at the bindings.mcp.cloudflare.com/sse entry point and trace how OAuth scopes are requested for the Workers Bindings MCP server. Compare the requested permissions with the read-only scope list in the issue, then verify that the read-only invocation grants no write or Background Access permissions.

Written by the indexing model from the issue text.