fix: validate session initialization events (v1)

[jazhang00]

Backport of commit 3fa71b6 to the v1 release line, where this code lives in adk_web_server.py rather than api_server.py.

Prevent client-supplied session initialization events from seeding ADK runtime state, and tighten HITL confirmation resumption. Session initialization events cannot carry ADK runtime state, and only a call named adk_request_confirmation is read as a confirmation request.

Fixes #5290

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: Reject runtime tool protocol events during session initialization #5290

Testing Plan

Please describe the tests that you ran to verify your changes. This is required
for all PRs that are not small documentation or typo fixes.

Unit Tests:

• I have added or updated unit tests for my change.
  • test_create_session_accepts_initial_text_events
  • test_create_session_accepts_initial_tool_events
  • test_create_session_rejects_adk_protocol_calls
  • test_create_session_rejects_long_running_tool_ids
  • test_create_session_rejects_runtime_action_events
  • test_resolve_confirmation_targets_requires_adk_name
• All unit tests pass locally.
• pre-commit (isort, pyink, addlicense) clean.