feat(dockhand): support build-time dependency constraints via build_with

[danbarr]

Summary

• Adds a build_with field to spec.yaml, wired through dockhand's Dockerfile generation into ToolHive's existing templates.RuntimeConfig.BuildWith support (--build-with in the thv CLI). This lets a uvx:// server's spec pin PEP 508 constraints on transitive dependencies (e.g. mcp<2) that the upstream package itself leaves unbounded, without waiting on an upstream release.
• Driving case: adb-mysql-mcp-server (the smoke test canary in build-containers.yml) has been failing to build with ModuleNotFoundError: No module named 'mcp.server.fastmcp'. Root cause is upstream: it depends on mcp[cli]>=1.8.0 with no upper bound, and mcp 2.0.0 (just released) removed the fastmcp module it imports at startup. This PR fixes it by pinning build_with: ["mcp<2"] in its spec.yaml.
• build_with is uvx-only, matching ToolHive's own restriction: ToolHive rejects (rather than silently ignores) a non-empty BuildWith for npx:///go:// builds, and this rejection fires through dockhand too since it happens before dry-run Dockerfile generation. Verified with a throwaway npx spec.
• The mcp-security-scan CI job scans the package independently of the built container image, by invoking uvx directly against the raw package. Pinning build_with alone didn't fix that job, since it never went through dockhand. Extended scripts/mcp-scan/generate_mcp_config.py to pass the same constraints via uvx --with, and fixed run_scan.py's argparse handling for --stdio-arg values that themselves start with - (same class of issue already worked around for npx's --yes).
• Documented build_with in docs/adding-servers.md, including a Troubleshooting entry and a worked example based on the adb-mysql-mcp-server fix.

Note on overlap: #669 (branch feat/dep-overrides, refs #668) already implements a similar mechanism, a hand-rolled spec.constraints/spec.overrides field patched into the Dockerfile by content-matching. #741 carries a rebased copy of that same commit plus a follow-up that uses it for next-devtools-mcp. Both PRs are open and unmerged. This PR takes a different approach, wiring through ToolHive's own native --build-with flag instead of maintaining our own patching/escaping logic, which seems the more correct long-term direction — flagging the overlap so it's visible during review.

Test plan

• go build ./cmd/dockhand/... succeeds
• dockhand build -c uvx/adb-mysql-mcp-server/spec.yaml generates a Dockerfile containing uv tool install --with 'mcp<2' ...
• docker build of the generated Dockerfile installs mcp==1.29.0 (not 2.0.0)
• docker run --rm adb-test --help starts cleanly and activates tools/resources with no ModuleNotFoundError
• Confirmed build_with on a non-uvx spec errors clearly rather than being silently ignored
• generate_mcp_config.py for adb-mysql-mcp-server emits uvx --with mcp<2 adb-mysql-mcp-server@2.0.0
• Ran run_scan.py against that config locally: scan completes (exit 0), all tools reported SAFE, no ModuleNotFoundError
• Confirmed npx's --stdio-arg=--yes handling is unaffected by the run_scan.py change

🤖 Generated with Claude Code

[toolhive-release-app]

🛡️ Skill Security Scan Results

⚠️ No skills were scanned in this PR.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

[danbarr]

Superseded by #669, closing.

--build-with maps to uv tool install --with, which adds a requirement the resolver has to satisfy jointly. That works for the case here, since adb-mysql-mcp-server leaves mcp unbounded and there is no conflict to resolve around. It cannot force past a dependency the upstream package has explicitly pinned or capped, which is the case #668 exists for (for example mcp-clickhouse capping fastmcp <3.0.0 below the version that fixes a CVE). npm has no soft-constraint equivalent at all, only hard overrides.

#669 uses the real override mechanisms (uv tool install --overrides and npm overrides), which covers both that harder case and this one. The adb-mysql-mcp-server fix has moved there, along with the security scan fix from this PR.