Also gate the response endpoint where the transport is acquired

Corrects a claim I had made: CXF does not check at the inbound-parsing layer.
Its check sits in DecoupledDestination.getBackChannel -- the method that hands
back the conduit for a decoupled response -- so anything reaching for that
back channel is screened however the endpoint reference arrived. Checking only
in AddressingInHandler was weaker, and the report's proof-of-concept showed
it: it builds
a MessageContext, calls setReplyTo directly and drives the transport sender,
never passing through header parsing, and the server still connected out.

MessageContextBuilder.setupCorrectTransportOut is the Axis2 analogue. It runs
only for a server-side response to a non-anonymous, non-none destination, and
it is where that destination's transport is resolved -- the same depth as CXF's
check. The policy therefore moves to the kernel org.apache.axis2.addressing
package, beside EndpointReference and AddressingFaultsHelper, so both the
handler and the kernel can use it. The handler check stays: it faults early
with a proper wsa fault on the path a remote caller actually has.

The PoC now fails on both its positive cases. The resolver pool shutdown moves
from the addressing module to AxisConfiguration.cleanup(), next to the
multipart reaper, since the policy is no longer module-scoped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>