GHSA-q855-8rh5-jfgq: ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

In Home Assistant add-on mode (v7.6.0 and earlier), certain settings routes were accessible at the root port (`:9583`) without authentication (no secret, CSRF token, or origin check), allowing anyone on the local network to read or modify tool configurations, feature flags, backups, restart the add-on, and manage approval policies if enabled. The MCP endpoint itself remained protected, and there was no access to Home Assistant data or credentials.