fix(middleware): prevent authentication bypass via health check User-Agent matching

[hacktron-app-dev]

Description

This PR fixes a critical authentication bypass vulnerability in the health check middleware (pkg/middleware/healthcheck.go).

1. User-Agent Bypass on Arbitrary Paths: The health check middleware matched configured health check User-Agents (such as GoogleHC/1.0 or PingUserAgent) on any incoming request path. In forward-authentication setups (e.g., Nginx auth_request), an attacker could send a request to a protected endpoint (like /admin) with a health check User-Agent. The reverse proxy would forward this request to /oauth2/auth with the same User-Agent, which oauth2-proxy's health check middleware intercepted and returned 200 OK. The reverse proxy interpreted this as successful authentication, granting the attacker access.
2. Default Empty User-Agent Bypass: By default, PingUserAgent is "". Since empty strings were not filtered out when constructing the trusted User-Agent set, any request lacking a User-Agent header matched "" and bypassed authentication.

Fixes

1. Restricted User-Agent Matching: Restricted User-Agent-based health check matching to ONLY the root path (/). This ensures health checks work correctly for GCP/GKE (which target / with GoogleHC/1.0), but prevents bypasses on other paths (such as /oauth2/auth or /admin).
2. Filtered Empty User-Agents: Filtered out empty strings ("") when constructing userAgentSet, ensuring empty User-Agent headers never match the health check criteria.

Verification

• Updated existing test cases and added new regression tests in pkg/middleware/healthcheck_test.go to verify that:
  • A health check User-Agent does NOT bypass authentication on non-root paths.
  • An empty User-Agent does NOT match when the configured PingUserAgent is empty.

---

Automated fix by Hacktron for finding: http://dev.app.hacktron.ai/testset/findings/3f3e65e9-ec06-48eb-aef7-f7bd05787540