Strip forwarded headers at proxy boundary

[ioquatix]

Summary

• Strip inbound forwarding/provenance headers before Falcon adds its own proxy-derived values.
• Add an overridable prepare_forwarded_headers hook for deployments that need to preserve or transform trusted upstream headers.
• Cover default stripping and override behavior in proxy middleware tests.

Tests

• bundle exec sus test/falcon/middleware/proxy.rb