fix: strip hop-by-hop headers from the upstream response on the http1 path

[pacocartones]

What

On the HTTP/1 downstream path, the upstream response headers were forwarded verbatim:

copyHeaders(rewriteHeaders(res.headers, this.request), this)

Any hop-by-hop header the upstream set — keep-alive, proxy-connection, transfer-encoding, or a header it named in its own Connection header — leaked straight to the downstream client. RFC 7230 §6.1 forbids a proxy from forwarding these; they belong to a single transport hop.

The HTTP/2 downstream branch a few lines above already strips them:

rewriteHeaders(stripHttp1ConnectionHeaders(res.headers), this.request)

This applies the same stripHttp1ConnectionHeaders call to the HTTP/1 branch, so both downstream transports behave identically.

Test

Adds test/strip-connection-headers-response.test.js. It reads the raw HTTP/1 response the proxy sends downstream (undici hides some headers, so the test uses node:http directly) and asserts the upstream's Keep-Alive, proxy-connection and a Connection-listed custom header are all stripped, while end-to-end headers like content-type survive.

Verified the test fails on the current code (upstream Keep-Alive should be stripped) and passes with the fix — a genuine regression guard, not a tautology.

npm run test:unit → 166 pass / 0 fail (5 skipped for env). npm run test:typescript clean.

Scope

One line changed in index.js plus its test. This touches only the response path (upstream → client); it is independent of #489, which touches the request path, and the two can merge in either order.

[pacocartones]

Thanks for the review on the response-side fix. The branch is still even with main with CI green, so nothing has drifted since the approvals. Happy to rebase or adjust anything if you'd prefer.

[mcollina]

CI is red

[pacocartones]

CI is red

Done :)