GHSA-f59h-q822-g45g: Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Caddy web server has a security flaw in how it handles headers when using `forward_auth copy_headers` (a feature that copies trusted identity headers from an authentication service) combined with `php_fastcgi` (a module that forwards requests to PHP). An attacker can send a header with underscores (like `Remote_Groups`) instead of hyphens (like `Remote-Groups`), and Caddy will delete only the hyphenated version. Later, when FastCGI converts headers to CGI variables (environment variables used by backend applications), it replaces all hyphens with underscores, causing the attacker's underscore header to become identical to the trusted header. This allows an attacker to inject fake identity or group information into PHP applications.