Swap every header that carries a placeholder

[czpython]

What changes

• Swap.requestheaders collects every header whose value carries a placeholder, once, from the original headers. Swap.swap authorizes each placeholder for the CONNECT host, then deletes the carrying headers and writes the headers the exchange names, all at once.
• One refused placeholder answers 403 and leaves the request untouched and unsent. An exchange that falls silent partway answers 503 the same way. Two placeholders that resolve to the same destination header answer 403.
• A credential the exchange returns is never scanned as a placeholder, since the scan happens before any write.
• Tests: bearer plus a custom header, the same in reverse order, a conflict on one header with and without case, a repeated field with a placeholder in each, a refused second placeholder, an exchange down after one answer, and a credential that looks like a placeholder. The single-header, Basic, host, and streaming tests are unchanged and pass.
• docs/security.md and docs/architecture.md say the proxy swaps every header that carries a placeholder and that one refusal refuses the whole request.

Where this differs from the ticket

• Nothing. URL and body substitution stay out, and one entry still holds one value.

Names

None new. Swap.swap takes the placeholders it found, a map from header name to placeholder, instead of one pair.

Gates

uv run ruff check, uv run ruff format --check, uv run pyright, and uv run pytest are green.

Review

Pending.