revert: remove frozenset coercion in ResourceSecurity.__post_init__

Passing a mutable set to a frozen dataclass and expecting hash() to
work is a caller error, not something the SDK needs to defend against.

Author: maxisbey

src/mcp/server/mcpserver/resources/templates.py

@@ -54,11 +54,6 @@ def git_diff(range: str) -> str: ...
     exempt_params: Set[str] = field(default_factory=frozenset[str])
     """Parameter names to skip all checks for."""
 
-    def __post_init__(self) -> None:
-        # Coerce to frozenset so the dataclass stays hashable even if
-        # callers pass a regular set.
-        object.__setattr__(self, "exempt_params", frozenset(self.exempt_params))
-
     def validate(self, params: Mapping[str, str | list[str]]) -> str | None:
         """Check all parameter values against the configured policy.
 

tests/server/mcpserver/resources/test_resource_template.py

@@ -89,14 +89,6 @@ def test_matches_null_byte_check_can_be_disabled():
     assert t.matches("file://docs/key%00.txt") == {"name": "key\x00.txt"}
 
 
-def test_resource_security_hashable_with_regular_set():
-    # Frozen dataclass auto-generates __hash__ from all fields, so a
-    # mutable set would make the instance unhashable. __post_init__
-    # coerces to frozenset.
-    policy = ResourceSecurity(exempt_params={"a", "b"})
-    assert hash(policy) == hash(ResourceSecurity(exempt_params=frozenset({"a", "b"})))
-
-
 def test_security_rejection_does_not_fall_through_to_next_template():
     # A strict template's security rejection must halt iteration, not
     # fall through to a later permissive template. Previously matches()