fix(server): compare allowed_hosts and allowed_origins case-insensitively

[EngineerOnTravel]

Summary

Fixes #3437

Per RFC 9110, URI schemes and host components are case-insensitive. WHATWG-URL compliant clients (Node.js, fetch, undici, browsers, and mcp-remote) normalize request host names to lowercase before sending requests on the wire.

When TransportSecuritySettings was configured with uppercase hostnames or machine names (e.g. derived from %COMPUTERNAME% on Windows), TransportSecurityMiddleware._validate_host() and _validate_origin() performed case-sensitive string matching against incoming lowercase headers, rejecting valid clients with HTTP 421 Misdirected Request or HTTP 403 Forbidden.

Changes

• src/mcp/server/transport_security.py: Normalize host, origin, and the configured allowed_hosts / allowed_origins lists to lowercase before performing exact comparisons and wildcard-port prefix matching.
• tests/server/test_transport_security.py: Added test cases covering uppercase and mixed-case incoming headers, uppercase configured allowlists, and wildcard port patterns.

Verification

• pytest tests/server/test_transport_security.py (30/30 passed)
• Full test suite across repo passed (5,872 passed)
• Code formatting and linting (ruff) passed with 0 errors

[github-actions]

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3437.

If a maintainer assigns you to #3437, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

• We're a small team with very little capacity to review community PRs right now.
• Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.