test(conformance): enable DNS rebinding protection in everything server

The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.

Author: felixweinberger

test/conformance/expected-failures.yaml

@@ -4,6 +4,3 @@
 client:
     - auth/pre-registration
     - auth/cross-app-access-complete-flow
-
-server:
-    - dns-rebinding-protection

test/conformance/src/everythingServer.ts

@@ -9,6 +9,7 @@
 
 import { randomUUID } from 'node:crypto';
 
+import { localhostHostValidation } from '@modelcontextprotocol/express';
 import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult, EventId, EventStore, GetPromptResult, ReadResourceResult, StreamId } from '@modelcontextprotocol/server';
 import { isInitializeRequest, McpServer, ResourceTemplate } from '@modelcontextprotocol/server';
@@ -876,6 +877,9 @@ function createMcpServer() {
 const app = express();
 app.use(express.json());
 
+// DNS rebinding protection: reject non-localhost Host headers
+app.use(localhostHostValidation());
+
 // Configure CORS to expose Mcp-Session-Id header for browser-based clients
 app.use(
     cors({