Headless Server: Persisted-query cache poisoning fixed

The Headless Server now rejects persisted-query requests whose body does not match the query registered under the supplied queryId or sha256Hash. Previously, a request that combined a known persisted-query ID with a foreign query body was executed and the resulting document was pinned under that ID in the per-instance in-memory cache, replacing the effective query on that JVM until the container was restarted. Behind a load balancer this could cause the same client request to return alternating responses depending on which instance handled it.

On mismatch the server now responds with PersistedQueryIdInvalid and does not update the cache. Marker-only requests (PersistedQueryMarker), empty bodies, and Automatic Persisted Query (APQ) registrations with a matching hash continue to work unchanged. No API or configuration changes are required.

(CMS-31338)