Python: Model MCP and FastMCP server handler parameters as remote sources (#22702)

[Tito0015]

Summary

Fixes #22702.

This PR adds QL framework modeling for Python MCP (Model Context Protocol) and fastmcp server handler parameters as RemoteFlowSources.

Why QL Modeling instead of Models-as-Data (YAML)

Existing open PR #22703 models MCP via Models-as-Data (MaD) YAML (ThreatModelSource of kind remote). However, several legacy Python security queries (such as py/nosql-injection, py/xml-bomb, and py/xxe) query RemoteFlowSource::Range directly and do not consume MaD sources. Additionally, MaD currently misses tool handlers wrapped behind stacked custom decorators.

Modeling via Mcp.qll extending RemoteFlowSource::Range resolves both gaps natively.

What is Modeled

• @mcp.tool(), @mcp.prompt(), @mcp.resource() (called and bare forms) across FastMCP and MCPServer (MCP 2.x).
• Standalone fastmcp @tool, @prompt, @resource, and fastmcp.tools.tool.
• Function registration via add_tool(...).
• def and async def functions, methods registered via @self.mcp.tool(), and stacked decorators (@other above @mcp.tool()).

Exclusions

• Method receivers (self / cls).
• Parameters type-annotated as Context (or Context | None / Optional[Context]).

Testing

• Added unit tests under python/ql/test/library-tests/dataflow/remote-flow-sources/ covering sync/async, bare/called decorators, keyword-only args, stacked decorators, and negative exclusion cases.
• All tests pass locally via codeql test run.