Authorize resourceSubscriptions on subscriptions/listen #1307

Problem

On the modern server, subscriptions/listen accepts any URI in resourceSubscriptions. SubscriptionsFeature never checks that the caller is allowed to access it. Change events are server-wide, so on a multi-tenant server a client can subscribe to another principal's URI and receive notifications/resources/updated for it. Only timing and existence leak, not content.

Desired outcome

Server implementers have a hook to gate subscriptions per URI.

Example, non-normative implementation:

• Add a canSubscribe(ctx, uri) hook to the resource repositories, defaulting to allow. subscriptions/listen drops every URI it denies.

Notes

• Filtering by find isn't suitable: subscribing to a resource that doesn't exist yet is legitimate.
• List-changed notifications have no payload and go to every listener. Document on McpChangeFeed that they aren't scoped per principal.

Credit

Reported by @hackking007