[CF-DATAPLANE][CPEX] Run resource hooks for resource reads

[lucarlig]

Summary

• add cmf.resource_pre_fetch and cmf.resource_post_fetch to the existing global CPEX runtime
• convert canonical resource requests and results to CMF while rejecting route changes and lossy response mutations
• run the hooks around resources/read
• use one supported-hook authority for runtime validation and factory registration
• use one named CMF invocation path and one shared MCP-resource-to-CMF converter
• verify direct and namespaced password-resource redaction with the bundled secrets-detection plugin

This intentionally keeps runtime configuration version 1 and the existing request-local PluginContextTable behavior. Scoped plugin bindings, trusted typed extensions, catalogs, caches, and runtime revisions are excluded. Those can be evaluated separately after IBM/mcp-context-forge#6252 defines the producer contract.

Part of IBM/mcp-context-forge#6253.

Verification

• cargo nextest run --workspace --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo deny check
• cargo shear
• repository pre-commit suite

Protocol-specific coverage is isolated in stacked PR #129.