fix(http): prevent duplicate transport-owned headers

[djwhitt]

Problem

When an HTTP backend is configured with a user-supplied Content-Type header, requests went out with two Content-Type headers (e.g. application/jsonapplication/json). Tesla middleware set the header by appending, and Tesla.put_headers/2 appends rather than de-duplicates, so the user's header survived alongside the transport's. Receivers concatenated the two values, failed to parse the body, and delivered an empty body.

Two paths exhibited this:

• Webhook-derived backends (Datadog, Loki, Elastic, Incident.io, …): Tesla.Middleware.JSON appends content-type when it encodes the body.
• OTLP backends: OtlpAdaptor passes user-configured headers alongside ProtobufFormatter, which always sets content-type to application/x-protobuf. A user-supplied content-type survived next to the formatter's.

Fix

Give transport-owned headers a single source rather than de-duplicating by header order (which is non-deterministic).

Shared plumbing:

• New Logflare.Backends.Adaptor.HttpBased.Headers with drop_reserved/2 (case-insensitive strip) and normalize_keys/1.

Webhook path:

• WebhookAdaptor.Client.send/1 strips the reserved set per request: content-type only when the JSON middleware will actually encode the body — binary payloads (e.g. NDJSON) keep a custom content-type — and content-encoding when gzip is enabled. authorization is intentionally not reserved here, since several adaptors set it directly.
• WebhookAdaptor.cast_config/2 lowercases header keys so stored config cannot hold case-variant duplicates of the same header.
• The redacted-secret restore path looks up existing values by normalized key, so a stored secret is not dropped when its casing differs from the submitted (possibly normalized) key.

HTTP-based / OTLP path:

• HttpBased.Client.new/1 strips content-encoding (gzip) and authorization (token/basic auth).
• The body is not known at client-build time, so the client cannot infer whether the JSON middleware will own content-type. Instead, a formatter that sets content-type itself declares ownership via an optional reserved_headers/0, and the client drops those names from user headers regardless of body. OtlpAdaptor.ProtobufFormatter and SentryAdaptor.EnvelopeBuilder declare ["content-type"].
• OtlpAdaptor.cast_config/2 lowercases header keys, matching the webhook path.