feat(gateway-target): expose MetadataConfiguration for header / query parameter propagation

[aidandaly24]

Description

AWS::BedrockAgentCore::GatewayTarget.MetadataConfiguration exposes three properties for HTTP header / query-parameter propagation that the CLI does not surface:

• AllowedRequestHeaders — Array of String — headers propagated from MCP client → upstream target.
• AllowedResponseHeaders — Array of String — headers propagated from upstream → MCP client.
• AllowedQueryParameters — Array of String — query params propagated end-to-end.

Source: MetadataConfiguration CFN docs.

CFN splits headers into request / response (unlike the data-plane API which uses a single allowedHeaders). The CLI's AgentCoreGatewayTargetSchema (src/schema/schemas/mcp.ts:339–546) has no metadataConfiguration block, and the L3 construct (@aws/agentcore-cdk — src/cdk/constructs/components/mcp/Gateway.ts) does not pass anything through.

This is the GatewayTarget counterpart to the existing requestHeaderAllowlist plumbing on Runtime (agent-env.ts:123–163) — same shape can be reused.

Acceptance Criteria

• Add a metadataConfiguration block to AgentCoreGatewayTargetSchema:
  • allowedRequestHeaders?: string[]
  • allowedResponseHeaders?: string[]
  • allowedQueryParameters?: string[]
• Add CLI flags: --allowed-request-headers, --allowed-response-headers, --allowed-query-parameters (each repeatable or comma-separated).
• Add corresponding TUI fields in AddGatewayTargetFlow.tsx.
• Pass through to CfnGatewayTarget.MetadataConfiguration.{AllowedRequestHeaders, AllowedResponseHeaders, AllowedQueryParameters} in the L3 construct.
• Validate against AgentCore-reserved prefixes (x-amz-*, x-amzn-*) consistent with Runtime allowlist validation.
• Snapshot tests updated.

Additional Context

• CFN support: YES — GatewayTarget.MetadataConfiguration (all three fields).
• L3 gap: yes — @aws/agentcore-cdk GatewayTarget construct needs corresponding plumbing.
• Naming nuance: CFN splits Request / Response headers; users will likely ask for a single "allowed headers" surface — keep both for parity with CFN, but document the distinction.
• Reuse the validator from agent-env.ts:123–163 for header name format.