fix: reject changed duplicate initialize

[he-yufeng]

Summary

• reject a second initialize request if it tries to change the session's client parameters
• keep the first client_params intact so later capability checks cannot be spoofed by a duplicate handshake
• add a regression test covering the changed-params path

To verify

• uv run pytest tests/server/test_session.py -q -k "duplicate_initialize or server_session_initialize"
• uv run ruff check src/mcp/server/session.py tests/server/test_session.py
• uv run pyright src/mcp/server/session.py tests/server/test_session.py
• uv run python -m py_compile src/mcp/server/session.py tests/server/test_session.py
• git diff --check

Closes #2605