mcp: remove early stop logic and add handle on duplicate key.

[botengyao]

Description

This PR introduces enhancements and security controls to the MCP JSON-RPC filter. It adds support for detecting and optionally rejecting duplicate JSON keys, clarifies body limit parsing behaviors, and fixes document formatting/spelling warnings.

Changes

1. Security & Parsing Enhancements

• JSON Parameter Pollution (JPP) Protection: Introduced reject_duplicate_keys configuration option to allow rejecting requests containing duplicate JSON keys at any nesting level. Defaults to false (last-key-wins).

• Last-Key-Wins Semantics: Standardized parser behavior to ensure the last duplicate key wins for both objects and primitive fields when duplicate rejection is disabled.

2. Body Size Limit Behavior Clarification:
   In PASS_THROUGH mode: allowed requests to proceed with partial parsing and a marked is_exceeding_limit flag in metadata.
   In REJECT_NO_MCP mode: rejected requests with 400 Bad Request if the payload exceeds the limit.

AI assisted and reviewed.

Commit Message:
Additional Description:
Risk Level: low
Testing: yes
Docs Changes:
Release Notes:
Platform Specific Features:

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #45202 was opened by botengyao.

see: more, trace.

[repokitteh-read-only]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @mattklein123
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #45202 was ready_for_review by botengyao.

see: more, trace.