Validate session initialization events

[petrmarinec]

Summary

Fixes #5290.

This change prevents client-supplied session initialization events from seeding ADK runtime/tool protocol state. Session initialization still accepts non-runtime conversation history, but rejects events containing function calls, function responses, long-running tool ids, or internal runtime EventActions fields.

It also tightens HITL confirmation resumption so adk_request_confirmation responses only resume tool calls that are backed by prior original function-call state and prior requested_tool_confirmations metadata in the event history.

Why

CreateSessionRequest.events is accepted from the HTTP API and appended to the new session. Those events should not be able to spoof ADK-generated runtime control state. Without this validation, a client can seed confirmation-shaped events and later send a matching confirmation response that causes a registered tool call embedded in originalFunctionCall to be resumed.

Tests

• python -m pyink --check src/google/adk/flows/llm_flows/request_confirmation.py src/google/adk/cli/adk_web_server.py tests/unittests/flows/llm_flows/test_request_confirmation.py tests/unittests/cli/test_fast_api.py
• python -m pytest tests/unittests/flows/llm_flows/test_request_confirmation.py tests/unittests/cli/test_fast_api.py::test_create_session_accepts_initial_text_events tests/unittests/cli/test_fast_api.py::test_create_session_rejects_runtime_tool_events tests/unittests/cli/test_fast_api.py::test_create_session_rejects_runtime_action_events tests/unittests/runners/test_run_tool_confirmation.py -q

Result: 17 passed.

Additional local check: tests/unittests/cli/test_fast_api.py passes on Windows with known baseline-local failures excluded: 61 passed, 4 deselected. The excluded cases are two CRLF assertion failures in builder GET tests and two A2A temporary-directory teardown errors; I reproduced those same failures on clean origin/main.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have added tests that prove my fix is effective.
• New and existing targeted unit tests pass locally with my changes; unrelated Windows baseline failures are documented above.

[rohityan]

Hi @petrmarinec , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Your PR has been received by the team and is currently under review. We will provide feedback as soon as we have an update to share.

[rohityan]

Hi @wukath , can you please review this.