feat: add support for 'tools' permission

[beaufortfrancois]

Motivation and Context

This change adds support for the 'tools' permission from the WebMCP specification, mapping it to the Permission Policy 'tools' feature.

How Has This Been Tested?

I've tried it locally by adding this code in my files:

// mcp-app.ts

(document as any).modelContext.registerTool(
  {
    name: 'webmcp-get-time',
    description: 'Returns the current application time.',
    execute: () => {
      const time = new Date().toISOString();
      return { content: [{ type: 'text', text: time }] };
    },
  },
  { exposedTo: ['http://localhost:8080'] },
);

// server.ts

  const permissions = { tools: {} };
  
  registerAppResource(
    server,
    resourceUri,
    resourceUri,
    {
      _meta: { ui: { permissions } },
      mimeType: RESOURCE_MIME_TYPE,
    },
    async () => {
      const html = await fs.readFile(path.join(DIST_DIR, 'mcp-app.html'), 'utf-8');

      return {
        contents: [{ uri: resourceUri, mimeType: RESOURCE_MIME_TYPE, text: html }],
      };
    },
  );

Then, I used WebMCP - Model Context Tool Inspector extension to verify it was properly registered. Without this PR, registration fails because of the missing allow=tools on both iframes.

Breaking Changes

Nope.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed (I've assumed schema.json will be part of the documentation)

Additional context