Better CORS defaults for SSE transport

[jspahrsummers]

It's likely that most MCP servers accessible over SSE should be contactable by frontend web applications, which means the right CORS headers need to be set. The SDK should likely opt-in to this by default, with an opt-out available.

See also modelcontextprotocol/typescript-sdk#143.

[panz2018]

I have developed web servers that integrate MCP SSE functionality:

• Using FastAPI: fastapi_mcp_sse
• Using Starlette: starlette_mcp_sse

These servers can be extended with custom routes while retaining full MCP SSE capabilities. Thus, it is possible to add CORS or any other functions using FastAPI or Starlette functions.