fix: correct MCP transport security config to actually allow all hosts by default

The MCP library's TransportSecurityMiddleware only supports exact host
matches or "host:*" port wildcards. It does NOT support a standalone "*"
wildcard to mean "allow all hosts" — setting allowed_hosts=["*"] would
reject every connection because no Host header equals "*".

Worse, when transport_security=None was passed to FastMCP while its default
host is "127.0.0.1", FastMCP would auto-enable protection with strict
localhost-only rules, overriding GNS3's intent to allow all hosts.

Root cause analysis:
- FastMCP auto-enables DNS rebinding protection when host is localhost
  and no explicit TransportSecuritySettings is provided
- GNS3 was passing transport_security=None (indirectly via FastMCP's default)
  when protection was disabled, triggering the auto-enable
- The TransportSecuritySettings "allowed_hosts" list does NOT support "*"
  as a catch-all wildcard

This fix:
1. Always pass an explicit TransportSecuritySettings to FastMCP
   - Disabled: TransportSecuritySettings(enable_dns_rebinding_protection=False)
   - Enabled: TransportSecuritySettings(enable_dns_rebinding_protection=True, ...)
2. Restore mcp_allowed_hosts and mcp_allowed_origins config fields
3. Set mcp_enable_dns_rebinding_protection default to False (allow all hosts)

Behaviour:
- Default (no config change): all hosts can connect to MCP server
- With mcp_enable_dns_rebinding_protection=true: only configured hosts
- Aligns with GNS3 server's 0.0.0.0 binding policy

gns3server/api/routes/mcp/__init__.py

@@ -106,14 +106,20 @@ def _create_mcp_server() -> FastMCP:
     """Create MCP server with security settings from configuration."""
     cfg = Config.instance().settings.Server
 
-    mcp = FastMCP(
-        "GNS3 MCP Server",
-        transport_security=TransportSecuritySettings(
-            enable_dns_rebinding_protection=cfg.mcp_enable_dns_rebinding_protection,
-            allowed_hosts=cfg.mcp_allowed_hosts,
-            allowed_origins=cfg.mcp_allowed_origins,
-        ),
-    )
+    # Always pass an explicit TransportSecuritySettings to prevent FastMCP
+    # from auto-enabling protection when host is localhost (its default).
+    if cfg.mcp_enable_dns_rebinding_protection:
+        transport_security = TransportSecuritySettings(
+            enable_dns_rebinding_protection=True,
+            allowed_hosts=cfg.mcp_allowed_hosts or ["127.0.0.1:*", "localhost:*"],
+            allowed_origins=cfg.mcp_allowed_origins or ["http://127.0.0.1:*", "http://localhost:*"],
+        )
+    else:
+        transport_security = TransportSecuritySettings(
+            enable_dns_rebinding_protection=False,
+        )
+
+    mcp = FastMCP("GNS3 MCP Server", transport_security=transport_security)
     return mcp