Run plugin hooks for resource reads

[lucarlig]

Resource reads now run CPEX hooks before the backend fetch and before returning its contents. Plugins can allow or deny reads, rewrite a URI to an unambiguous target in the caller's published resource routes, and transform returned text or binary content.

Result transformations may change URI, MIME type and text/blob format. Existing MCP metadata and unchanged blob wire values are preserved. CMF-only envelope and descriptive fields no longer cause blanket rejection. Text takes precedence when both text and blob are supplied, matching the built-in serializer.

The request-owned hook state preserves the selected runtime across configuration reloads. Authorization checks and errors for content that cannot be converted to MCP remain. Prompt conversion is unchanged from the base branch; this PR adds no prompt-wide payload validation.

Part of IBM/mcp-context-forge#6253 and IBM/mcp-context-forge#6254. Effective policy selection and trusted request extensions remain separate framework work.

Validation: 238 all-feature workspace tests passed, with 13 existing skips. All-feature Clippy and build, formatting, dependency/license audit, cargo shear, and wiki build/test passed. Regression coverage includes direct/aliased routes, text/blob changes, metadata preservation, pre/post denial, allowed URI rewrites, unpublished/ambiguous targets and reload consistency. Focused checks against built-in CPEX 0.1.3 and the pinned gateway serialization source confirm the modified payload behavior; this is not a full two-dataplane parity certification.