Docs/examples: avoid wildcard CORS for StreamableHTTP

[TheodorNEngoy]

Updates the StreamableHTTP docs snippet + low-level examples to avoid allow_origins=["*"].

• Uses allow_origin_regex to allow browser clients from ChatGPT origins (https://chatgpt.com, https://chat.openai.com) and localhost dev (http(s)://localhost|127.0.0.1(:port))
• Keeps the intent of exposing Mcp-Session-Id for browser-based clients
• Docs/examples only; no runtime behavior changes to the SDK

This reduces the risk of copy/paste wildcard-CORS configs in MCP servers.

[maxisbey]

Thanks! Per our contributing guidelines, please open an issue first and wait for maintainer feedback before submitting PRs.

_{AI Disclaimer}