Harden error page response merging to strip framing headers

[matthewp]

Changes

• Strips Content-Length and Transfer-Encoding headers from the original response before merging in mergeResponses(), matching the existing treatment of Content-type
• Ensures framing headers from the original response do not carry over to a rendered error page that has a different body

Testing

• Added unit tests in middleware-app.test.js verifying that Content-Length and Transfer-Encoding from middleware responses are not preserved when rendering 404/500 error pages
• Non-framing custom headers (e.g. X-Custom) are confirmed to still be preserved

Docs

No docs changes needed.

[changeset-bot]

🦋 Changeset detected

Latest commit: d1e6420

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing fix/bugbot-142 (d1e6420) with main (c808fd5)}

[matthewp]

lgtm (i'm not actually the author).