Python: merge both approval lists in get_mcp_tool

[Manohar Paturi (ManoharPaturi)]

Motivation & Context

get_mcp_tool accepts an approval_mode dict and its docstring says the always_require_approval and never_require_approval keys can be used together. When both were supplied, the second assignment overwrote the first, so the always list was silently dropped and those tools were sent to the API as auto approved. The declarative loader already builds the combined mapping for the same API field, so the static helper was the outlier.

Description & Review Guide

• What are the major changes? The two branches now build one combined require_approval mapping instead of assigning it twice. Single key behavior is unchanged.
• What is the impact of these changes? Tools listed under always_require_approval keep requiring approval when a never list is also present. No other call sites are affected.
• What do you want reviewers to focus on? The merged shape mirrors _loader.py for McpServerToolSpecifyApprovalMode, which is the closest sibling for the same field.

Related Issue

Fixes #9498

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.