SEP: ui/message user consent

[idosal]

The ui/message UI action allows apps to send messages on behalf of the user, which may be a sensitive operation.

While the ability to inject context from an MCP server already exists, this (potentially) new attack surface may warrant user consent.

Raised by @PederHP (see SEP PR) and @ochafik.

[idosal]

The proposal is that the SEP will not dictate the behavior. Different hosts may have different requirements based on UX, policy, or user configuration. The same considerations also apply to Tool calls (even though the sensitivity may be slightly different).
I'll open a PR for feedback soon.