fix(debug): redact sensitive response headers

[fallintoplace]

Problem

Debug logging already clones and redacts request headers, but response headers were passed directly to httputil.DumpResponse. This exposed values such as Set-Cookie, response-side Authorization, and API-key headers whenever debug logging was enabled.

Fix

• share one case-insensitive header redaction path across requests and responses
• redact direct and proxy authorization while retaining only the authentication scheme
• shallow-copy the response before logging so the response returned to callers is untouched
• keep ordinary response headers available for debugging

Coverage

The response test covers multiple cookies, direct and proxy authorization, an API-key header, deliberately non-canonical casing, a visible request ID, and both header and response-object identity.

Validation

• ./scripts/test
• go test -race ./internal/debugmiddleware -count=1
• go vet ./...
• ./scripts/lint