filesystem: tool calls use the old allow-list while a roots refresh is pending #5101

Problem

In the filesystem server, tool calls wait for the initial roots load (#3204), and since #5097 for a refresh that overtakes it, but a normal runtime notifications/roots/list_changed does not hold them back. While its roots/list request is pending, tool calls are authorized against the previous allow-list, so a client that has announced that a root is gone can still have it read or modified until the answer arrives.

Reported by Copilot on the v1.0.0 merge PR #5090 (thread r4237017991). Follows #5094 and #5097.

Reproduce

1. A Roots client exposes one root; list_directory on it succeeds.
2. The client withdraws the root and sends notifications/roots/list_changed, but answers the server's roots/list slowly.
3. A list_directory on the root sent during that wait succeeds against the old allow-list.

Expected

Every roots refresh is a barrier: a tool call that arrives while a refresh is pending waits for it (and for any newer one that overtakes it), then runs against the result. If the refresh fails, waiting calls proceed against the current allow-list, as today.