Support workspace-authorized external MCP plugin reads

[meanderix]

Thanks for the recent additions in PR #5038 . Here's a small addendum request:

Allow external plugin MCP tools to request a workspace scope. Kandev should authorize the requested workspace using the authenticated caller’s existing PAT/session permissions and pass the verified workspace context to the plugin, without requiring task/session identities or forwarding credentials. This would let plugins expose workspace-owned data without implementing separate authentication.

[carlosflorencio]

#5107

Supported here @meanderix 💪