chore: migrate off deprecated cpex payload .headers

[Shaurya2k06]

Related Issue

Closes #5828

Related: #5825 (warning noise EPIC), #5832 (upstream removal / cpex pin bump — not closed here)

---

Summary

Migrate gateway hosts, header-touching plugins, and tests off deprecated cpex payload .headers onto extensions.http.headers.

Helper

• build_hook_extensions() / headers_from_modified_extensions() in mcpgateway/plugins/utils.py

Hosts

• tool_service.py, a2a_service.py: omit payload headers=; pass/read via extensions
• http_auth_middleware.py, auth.py: dual-write (payload .headers still required in cpex 0.1.1; real data on extensions.http)

Plugins

• header_filter, vault (write_headers); jwt_claims, unified_pdp, telemetry (read_headers); sparc; examples
• Matching capabilities in plugins/config.yaml

Tests

• Call sites updated; no filterwarnings suppressions

Residual warnings: HttpPreRequest (~13) and HttpAuthResolveUser (~20) remain until upstream makes those fields optional (#5832).

---

Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate

---

Type of Change

• Chore (deps, CI, tooling)

---

Verification

Check	Command	Status
Unit tests	make test	✅ 20847 passed; Tool/Agent .headers warnings = 0
Lint / security / docs / verify	make ruff bandit interrogate pylint verify	✅

---

Checklist

• Tests added/updated for changes
• No secrets or credentials committed
• No filterwarnings suppressions for these deprecations