Remove magic from `res.set`

[blakeembrey]

Currently res.set includes some magic that is probably unexpected for most users. It's only for content-type, but if it looks like an invalid content type (no /) we do a mime type lookup. In v6 we should change this to avoid mutating user input when setting a header, especially since a method already exists to do this: res.type.

This was brought up due to a bug in the logic: #7034.

[IamLizu]

I agree the current res.set('Content-Type', ...) behavior is a footgun and that removing the implicit mime/charset mutation is a good direction for 6.x.

res.set is expected to be a generic header setter, but today it performs mime.contentType() and can rewrite values in surprising ways (including the "false" case in #7034). We already have res.type() as the explicit API for extension/mime resolution, so splitting responsibilities there is cleaner and easier to reason about.

I think a 6.x change makes sense, with migration guidance that:

• res.set('Content-Type', value) becomes pass-through header assignment.
• res.type(value) is the documented API for shorthand/extensions + mime lookup.

Clarifying questions before finalizing behavior:

• In 6.x, should invalid media-type strings passed to res.set('Content-Type', ...) stay pass-through, or should Express throw early with a clearer error?
• Do we want to preserve Express-level array validation/message for Content-Type, or rely on Node’s setHeader error behavior?
• Should we pair this with explicit migration note/examples (e.g. “use res.type('html') instead of res.set('Content-Type', 'html')”)?

If this direction is confirmed, PR #7146 looks aligned with the proposal and can be evaluated against those final policy choices.