⬆️ (semantic-kernel-tool-policy): Bump mcp to 1.28.1 (GHSA-vj7q-gjh5-988w)

The semantic-kernel 1.44 bump (#328) left mcp resolving to 1.27.2, still
vulnerable to GHSA-vj7q-gjh5-988w (mcp WebSocket server Host/Origin
validation, fixed 1.28.1) — Dependabot #35. semantic-kernel only floors
mcp>=1.26.0, so add a direct mcp>=1.28.1 requirement to force the patched
version. The example runs no mcp WebSocket server (vuln not reachable) but
pin it patched regardless. uv sync --extra dev resolves; 6/6 tests pass.

Refs AAASM-4780

Author: Chisanan232

python/semantic-kernel-tool-policy/pyproject.toml

@@ -19,6 +19,11 @@ dependencies = [
     # keeps everything else (notably `mcp`) on stable releases.
     "azure-ai-agents>=1.2.0b3",
     "azure-ai-projects>=1.0.0b12",
+    # Direct floor to pull the patched mcp (GHSA-vj7q-gjh5-988w, fixed
+    # 1.28.1); semantic-kernel only floors mcp>=1.26.0 so the transitive
+    # otherwise resolves to a vulnerable 1.27.x. Example runs no mcp
+    # WebSocket server, but pin it patched regardless.
+    "mcp>=1.28.1",
 ]
 
 [project.optional-dependencies]