Allow ESI shared-template caching behind basic auth

[prk-Jr]

Summary

• Allow ESI shared-template caching when Trusted Server has already validated the request Basic Auth credential at the edge.
• Preserve the fail-closed bypass for publisher-origin credentials and ambiguous repeated Authorization fields.
• Carry the server-only authentication decision through all four adapter middleware stacks without modifying the forwarded header.

Changes

File	Change
crates/trusted-server-core/src/auth.rs	Add the request marker, fail closed on repeated Authorization fields, and add marker lifecycle regressions.
crates/trusted-server-core/src/publisher.rs	Exempt exactly one edge-terminated credential from cache bypass and independently reject repeated values.
crates/trusted-server-adapter-fastly/src/middleware.rs	Pass the mutable request through Basic Auth middleware.
crates/trusted-server-adapter-axum/src/middleware.rs	Pass the mutable request through Basic Auth middleware.
crates/trusted-server-adapter-cloudflare/src/middleware.rs	Pass the mutable request through Basic Auth middleware.
crates/trusted-server-adapter-spin/src/middleware.rs	Pass the mutable request through Basic Auth middleware.

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare && cargo test-spin
• All six target-specific Clippy gates
• cargo fmt --all -- --check
• Native core suite: 2,216 tests
• Regression tests cover pass-through, edge-terminated, and repeated Authorization behavior
• JS tests
• JS format
• Docs format
• Manual staging validation

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap calls added to production code
• No println calls added
• New code has regression tests
• No secrets or credentials committed

No linked issue for this PR, per request.