fix(vmcp): vmcp creates authz middleware

[jerm-dro]

Summary

Authz configuration is currently in the vMCP server's spec: https://github.com/stacklok/toolhive/blob/jerm/2026-01-27-fix-authz-dropped/pkg/vmcp/config/config.go#L180

However, this config is ignored and not applied resulting in cedar policies not being enforced.

This PR updates NewIncomingAuthMiddleware so it correctly enforces the cedar policies.

Testing

The newly added regression tests failed without this fix:

The tests now pass.

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.96%. Comparing base (2acfcfc) to head (be97cd7).
⚠️ Report is 16 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/vmcp/auth/factory/incoming.go	71.42%	4 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3474      +/-   ##
==========================================
+ Coverage   64.95%   64.96%   +0.01%     
==========================================
  Files         396      396              
  Lines       38492    38540      +48     
==========================================
+ Hits        25001    25037      +36     
- Misses      11542    11552      +10     
- Partials     1949     1951       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.