GHSA-7r4p-vjf4-gxv4: Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

# Analysis ## Summary Caddy's `forward_auth` directive with `copy_headers` fails to remove client-supplied headers when an upstream auth service (an external server that validates user identity) doesn't include those headers in its response, allowing an authenticated attacker to inject arbitrary values for trusted identity headers and escalate privileges. This regression was introduced in November 2024 and affects all stable versions from v2.10.0 onward. ## Solution The source text states: "