Wildcard-port patterns in DefaultServerTransportSecurityValidator accept non-numeric ports #1192

Servers that bind to a runtime-chosen localhost port use allowedHost("127.0.0.1:*") / allowedOrigin("http://localhost:*") in DefaultServerTransportSecurityValidator as their DNS-rebinding defense. The wildcard check is a bare prefix match (startsWith(base + ":")), so Host: 127.0.0.1:evil.com, 127.0.0.1:80.evil.com, Origin: http://localhost:evil.com and http://localhost:3000.evil.com all pass.

Browsers can't send these, so it's hardening, not an exploitable bypass. I found it comparing the SDKs: python-sdk has the same open issue (modelcontextprotocol/python-sdk#3364) and the Swift SDK already requires a digits-only port.

Proposal: require a non-empty digits-only port after the prefix. Patch and tests ready if wanted.