Pin Tool API and MCP Server tool-bridge floors

### Problem/Motivation

composer.json requires drupal/tool as "*". GraphQL Compose Codegen MCP already requires Tool API >= 1.0.0-beta8. A Composer solve can install an older Tool API that does not satisfy that floor.

mcp_sentinel_server.info.yml depends on mcp_server:mcp_server_tool_bridge with no version. mcp_server 2.0.0-beta3 moved its plugin directory. A stale bridge answers HTTP 200 with zero tools.

### Proposed resolution

- Require drupal/tool ^1.0.0-beta8 and tool:tool (>=1.0.0-beta8).
- Depend on mcp_server_tool_bridge 2.0.0-beta3 or later, and pin the drupal/mcp_server test dependency to ^2.0.0-beta3.

### Remaining tasks

The pins are on the 1.x branch. Cite this issue in CHANGELOG. Do not cut a release solely for this.

### User interface changes

None.