Send proxy custom headers only to the proxy

[hyperxpro]

Motivation:

ProxyServer custom headers are meant for the proxy, but they were applied in sendRequestWithNewChannel without checking the proxy type. A SOCKS proxy never reads the HTTP request it carries, so they went to the
origin instead - the same inversion the Proxy-Authorization gate prevents one sink below.

That placement also meant only the first request on a connection carried them. Every pooled request lost them, as did a 407-rejected CONNECT replayed on the same channel.

Modification:

Apply them in NettyRequestFactory.newNettyRequest under the predicate that already guards Proxy-Authorization, so they ride an absolute-form request or a CONNECT and never a request the proxy tunnels to the origin. Before the generated header, so a realm still decides Proxy-Authorization.

Per name rather than wholesale, now that every request carries them: Content-Length, Transfer-Encoding and Upgrade are dropped, and the rest replace rather than append, since two Host lines are a 400. Connection is the exception - it is list-valued, and replacing it would drop the close token keepAlive=false puts there.

The function is caller code and can throw, as can a CR or LF in what it returns. Nothing owns the request that early, so release it before rethrowing.

Result:

Custom headers reach the proxy alone, on every request rather than the first. Over SOCKS they are no longer sent: set the header on the request if the origin should see it, and name it in a Connection header of the same set if the proxy should strip it.