[ajruckman]

• reuse shared gRPC connection for token introspection to avoid double connections
• prevent duplicate+concurrent introspection requests; cache introspection results (this is token-extension-safe because our service doesn't gate on expiration)
• validate MCP transport and authorization headers before introspection
• constrain documentation search inputs and their complexity
• update to Go 1.27.1
• update+revendor dependencies

[paulbry]

lgtm