Fix HTTP MCP auth token precedence

[Widthdom]

Summary

• Make HTTP MCP use one bearer authentication contract, preferring CDIDX_MCP_HTTP_TOKEN and falling back to CDIDX_MCP_AUTH_TOKEN.
• Keep stdio JSON-RPC params.auth.token behavior unchanged while preventing HTTP from also requiring the body-token gate.
• Document the precedence and add changelog.d/unreleased/3156.security.md.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ProgramRunnerTests|FullyQualifiedName~HttpMcpTransportTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• git diff --check / git diff --cached --check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

Fixes #3156