feat(strata): add read-only action scope

[RitwijParmar]

Summary

• preserve upstream MCP tool annotations in MCPClient.list_tools() so Strata can reason about readOnlyHint
• add optional scope: "read_only" filtering to discover_server_actions, get_action_details, search_documentation, and execute_action
• reject execution of non-read-only actions when read-only scope is requested
• document the new scope option in the open-source Strata README

Closes #534

Testing

• ./.venv/bin/python -m pytest tests/test_read_only_scope.py
• ./.venv/bin/python -m pytest tests/test_config.py tests/test_mcp_client_manager.py -m "not integration"
• ./.venv/bin/python -m compileall -q src/strata tests/test_read_only_scope.py
• git diff --check