MCP Python SDK v1.30.0 restricts HTTP redirects, adds idle session expiry and issuer validation

The Model Context Protocol (MCP) Python SDK released version 1.30.0, a maintenance update for the 1.x line that introduces stricter security defaults and new configuration options.

• HTTP client redirects are now restricted to the endpoint's origin, preventing cross-origin redirections.
• Idle Streamable HTTP sessions automatically expire after 30 minutes of inactivity, with a cap of 10,000 concurrent sessions per server.
• The OAuth client validates that the authorization server's issuer matches the expected server, rejecting mismatches.
• New `AuthSettings.validate_token_resource` parameter allows verifying that bearer tokens are issued for the specific resource server.
• Deprecation warnings were added for `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` when used without an explicit `issuer` argument.