Support Approval path for MCP tools.

as per documentation https://developers.openai.com/api/docs/guides/tools-connectors-mcp
the first example is:

from openai import OpenAI

client = OpenAI()

resp = client.responses.create(
    model="gpt-5.6",
    tools=[
        {
            "type": "mcp",
            "server_label": "dmcp",
            "server_description": "A Dungeons and Dragons MCP server to assist with dice rolling.",
            "server_url": "https://dmcp-server.deno.dev/mcp",
            "require_approval": "never",
        },
    ],
    input="Roll 2d4+1",
)

which is the current supported shape in our gateway so far. since our current agentic loop not handling the approval path we can support that later.
The shape of require_approval : { "never": {"tool_names":[]}} is specific to filtering approval.
with example:

from openai import OpenAI

client = OpenAI()

resp = client.responses.create(
    model="gpt-5.6",
    tools=[
        {
            "type": "mcp",
            "server_label": "deepwiki",
            "server_url": "https://mcp.deepwiki.com/mcp",
            "require_approval": {
                "never": {
                    "tool_names": ["ask_question", "read_wiki_structure"]
                }
            }
        },
    ],
    input="What transport protocols does the 2025-03-26 version of the MCP spec (modelcontextprotocol/modelcontextprotocol) support?",
)

will make this comment to an issue for this to add for future support.

Originally posted by @maralbahari in https://github.com/vllm-project/agentic-api/pull/138#discussion_r3642803328

Enterprise Readiness

Enhancement outcome: applications can require human approval before executing selected Model Context Protocol (MCP) tools and resume the same Responses workflow after approval or rejection.

Acceptance criteria:

• Model the supported require_approval policies with typed request contracts, including supported tool-name filtering and explicit defaults.
• Emit mcp_approval_request and accept mcp_approval_response through the existing tool loop, preserving JSON/SSE and Responses WebSocket continuation.
• Persist server-owned pending approvals bound to the authenticated owner, issuing response, server/tool target, and exact arguments. Client-supplied records cannot grant permission.
• Approved calls are claimed atomically once; rejected, expired, mismatched, and already-consumed approvals do not execute tools.
• Persist approval state consistently with response state; define cleanup, cancellation, concurrent decisions, restart behavior, and retention without retaining unnecessary sensitive arguments.
• Tests cover approve/reject/resume, cross-tenant access, altered arguments/targets, duplicate decisions, crash boundaries, and a completed client lifecycle.

Coordinate with #107 for authenticated ownership. Approval enforcement must precede tool side effects; the implementation should reuse existing registry, executor, and storage boundaries.

Enterprise Readiness tracker: https://github.com/vllm-project/agentic-api/issues/316

Start by tracing the existing tool loop and the registry, executor, and storage boundaries mentioned in the issue. Then inspect how JSON/SSE and Responses WebSocket continuation work; done means approval requests and responses safely support approve, reject, resume, ownership, persistence, concurrency, and lifecycle tests from the acceptance criteria.