Remove ability to use parameter name _session and _request

[Nyholm]

These are reserved for internal use. This will fix #168

Motivation and Context

The _session and _request are used internally, they are not meant to be injected via argument injection.
An alternative to this PR would be to remove them in ReferenceHandler::prepareArguments(), but that would throw an exception when the tool is called. By doing it in the SchemaGenerator we get an exception when the server was started

How Has This Been Tested?

I modified an example and tested.

Breaking Changes

No. I consider this a bug fix. See #168.

The "feature" of naming a variable $_session is not documented nor covered by tests.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• [ x New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[chr-hertel]

Nice hardening - could you please extend the SchemaGeneratorTest briefly to bake this in?

[Nyholm]

Sure, will do

[Nyholm]

I've updated the PR with a test

[chr-hertel]

Thanks @Nyholm!

[Nyholm]

Thank you for merging