ROOT_PATH_SKIP_PREFIXES - trailing-slash prefix silently disables the skip, plus two sub-path-upstream edge cases

[lhoupert]

Sorry I was too slow to comment on #198 before it got merged, so opening this issue. The current version works well for its main use case (on a shared hostname). But when reviewing the final merged version of the PR, I found that the last commits may have introduced (or re-exposed) some edge cases where links come out wrong. The 1st can affect anyone using the middleware programmatically I think, the other two only trigger with an upstream URL mounted under a sub-path (e.g. UPSTREAM_URL=http://upstream/api).

I asked Claude to generate a minimalist example about them below so it is clearer:

1. A trailing slash in a prefix silently disables the skip

ProcessLinksMiddleware is exported from stac_auth_proxy.middleware, and it no longer normalizes its own prefixes (that now only happens in the Settings env-var validator). So constructing the middleware directly with a trailing slash:

ProcessLinksMiddleware(..., root_path="/stac", root_path_skip_prefixes=["/raster/"])

produces a prefix that matches nothing (no error, no warning). Concretely, for a link that the skip list is supposed to protect:

input link:      http://proxy.example.com/raster/tiles       (a link to the tiler app)
expected:        http://proxy.example.com/raster/tiles       (left alone — the whole point of the skip list)
actual v1.2.0:   http://proxy.example.com/stac/raster/tiles  (ROOT_PATH added anyway → broken link)

2. Two related edge cases when the upstream URL has a path

Both need UPSTREAM_URL mounted under a sub-path (e.g. http://upstream/api) and a name collision with a skip prefix (I agree it is a rare combination but I thought it is still maybe worth tracking this issue?).

a. Prefix string-collision with the upstream path mangles the link. E.g:

ProcessLinksMiddleware(
    ...,
    upstream_url="http://upstream.example.com/api",
    root_path="/stac",
    root_path_skip_prefixes=["/api-docs"],
)

leads to

input link:      http://proxy.example.com/api-docs/foo       (a link to the docs app on the public host)
expected:        http://proxy.example.com/api-docs/foo       (matches skip prefix /api-docs — left alone)
actual v1.2.0:   http://proxy.example.com/stac-docs/foo      (mistaken for upstream-internal: "/api" stripped, ROOT_PATH glued on → mangled)

b. An upstream route that looks like a skip prefix loses ROOT_PATH.

ProcessLinksMiddleware(
    ...,
    upstream_url="http://upstream.example.com/api",
    root_path="/stac",
    root_path_skip_prefixes=["/raster"],
)

leads to

input link:      http://upstream.example.com/api/raster/tiles   (a real endpoint inside the upstream API)
expected:        http://proxy.example.com/stac/raster/tiles     (public URL, routed back through the proxy)
actual v1.2.0:   http://proxy.example.com/raster/tiles          (path stripped before the skip check → matches /raster → points at the tiler app instead)

[lhoupert]

I raised #199 to address 1.