Add ETag conditional requests to the REST transport

[joshfree]

Summary

Adds HTTP conditional-request (ETag / If-None-Match) support to the REST transport so unchanged resources are revalidated with a 304 Not Modified instead of being re-downloaded in full.

Why

Every REST request is currently issued unconditionally: the ETag returned by the GitHub API is never stored or replayed, so repeated tool calls that read the same resource (for example pull request reads, file and commit listings, and reviews) download the full response each time.

Fixes #3025

What changed

• Added ETagTransport, a bounded (LRU), concurrency-safe http.RoundTripper that caches the ETag and body of cacheable GET responses and sends If-None-Match on the next identical request; a 304 Not Modified is served from the cached body.
• Wired ETagTransport into createGitHubClients() below the user-agent and auth layers, so cached entries are scoped by the request's Authorization header and never shared across tokens.
• Rate-limit headers are surfaced from the live 304 response so downstream rate-limit accounting stays correct.
• Added ETag / If-None-Match header constants.

Every request is still sent to the server, so responses are always revalidated and never served stale. Per the GitHub REST API docs, a 304 Not Modified does not count against the token's primary rate limit, so repeated reads conserve rate-limit budget and bandwidth while returning identical data.

MCP impact

• No tool or API changes

Security / limits

• Auth / permissions considered — cache keys include a hash of the Authorization header, so cached bodies are never served across different tokens.
• Data exposure, filtering, or token/size limits considered — the cache is bounded (default 512 entries, LRU eviction) and in-memory only.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Tested locally with go test ./pkg/http/transport/... (new etag_test.go covers the 304-serves-cached-body flow, per-token scoping, rate-limit header pass-through, GET-only caching, and caller-supplied conditional headers). go build ./... and go vet ./... pass.

Docs

• Not needed

[Copilot]

Pull request overview

Adds ETag-based conditional revalidation to GitHub REST requests to reduce bandwidth and rate-limit usage.

Changes:

• Adds a concurrency-safe LRU ETag transport.
• Integrates it into REST client construction.
• Adds header constants and transport tests.

Show a summary per file

File	Description
pkg/http/transport/etag.go	Implements ETag caching and revalidation.
pkg/http/transport/etag_test.go	Tests conditional-request behavior.
pkg/http/headers/headers.go	Adds ETag header constants.
internal/ghmcp/server.go	Enables the transport for REST clients.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced

[SamMorrowDrums]

Thanks for this, the aims make sense, however most of our usage is through the hosted remote server, which is horizontally scaled and so would need to think about this because it's pretty expensive to add a distributed store there, and additional Redis usage, extra network request per request that would normally be false adding latency, in-memory store would likely be much less useful and we also handle hundreds of RPS so really would need to think about this in that context.