…ternals (v2) (#4800)

- Only `GET` and `HEAD` requests read or write the handler cache; other
  methods and `Range` requests call the handler directly. `HEAD` uses a
  separate key (GET keys unchanged).
- Never store responses that set cookies; `set-cookie` is only sent to the
  request that produced the response, and concurrent requests resolve
  their own response instead of sharing it.
- Never store responses with `cache-control` private/no-store/no-cache and
  keep the handler's own `cache-control`.
- Never store responses whose `vary` is `*` or names a header not in
  `varies` (except `accept-encoding`).
- Remove a stored entry when a fresh response is no longer cacheable.
- Capture `appendHeader` in the response proxy (multiple cookies).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Validate the resolved `/**` proxy and redirect target against the target
base in addition to the request path. Canonicalize under both the fully
decoded and WHATWG readings so empty `//` segments, prefix re-entry,
raw dot segments with encoded separators and nested encodings cannot
escape the configured prefix. Encoded target bases keep working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…racters in wildcard redirects

A wildcard `redirect` rule targeting `/**` copied the rest of the request
path into `Location` and only collapsed a leading `//`. A remainder starting
with `\` (raw or `%5C`) or `<TAB>/` (`%09/`) was emitted unchanged, which
browsers resolve as protocol-relative `//evil.com` (GHSA-49p7-jc25-v5fc,
incomplete fix of GHSA-9phm-9p8f-hw5m).

- Move target resolution to a pure `resolveRedirectTarget()` helper
- Collapse any leading run of `/`, `\`, C0 controls/space and their
  percent-encoded forms to a single `/` (with and without strip base)
- Reject (400) remainders whose dot-segments would climb above a
  path-prefixed target base once normalized
- For root targets, always emit a path-absolute `Location` (also fixes
  the empty `Location` redirect loop for `/old` with `/old/**`)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>