fix(wolf-rbac): scope identity headers to route configuration

[shreemaan-abhishek]

Description

Wolf identity headers are part of the upstream contract of a Route or Service. Keeping header_prefix solely at Consumer scope makes that contract vary by Consumer and requires authentication orchestration to know about unrelated Consumer configurations.

This change makes the Route or Service configuration authoritative when header_prefix is explicitly configured:

• Wolf uses the Route prefix consistently for identity-header preparation and successful identity output.
• multi-auth invokes an optional preparation hook for configured authenticators before evaluation.
• Header preparation is constant-time and does not enumerate or cache Consumer configurations.
• When the Route omits header_prefix, the default namespace remains X-, while the matched Consumer prefix remains available as a compatibility fallback.
• Identity output is added only after Wolf authorization succeeds.

Regression coverage includes both multi-auth orderings, default and custom Route prefixes, successful Wolf authentication, Route precedence over Consumer configuration, and the Consumer compatibility fallback.

The documentation now recommends configuring header_prefix on the Route or Service that owns the upstream identity-header contract.

Behavior change

An explicitly configured Route or Service header_prefix now takes precedence over a Consumer-level value. Consumer-level prefixes remain supported when the Route omits the field.

Which issue(s) this PR fixes:

N/A

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have preserved Consumer-prefix behavior when the Route omits header_prefix