Normalize paths before payment access-control checks

[jillesme]

Summary

• canonicalize request paths before protected-route matching
• use the same canonical URL when forwarding requests to the origin
• match protected patterns case-insensitively to safely cover case-insensitive origins
• reject malformed, control-character, and nested encodings instead of passing ambiguous paths through
• add regression tests for duplicate slashes, encoded separators, casing, dot segments, backslashes, and the built-in protected endpoint

This prevents the payment/access-control decision from being made against a different path representation than the one interpreted by the origin.

Behavior change

Ambiguous paths with malformed or nested percent-encoding now return 400 Invalid request path rather than being proxied.

Testing

• npm test
• npm run lint