Remove non-lowercase headers in Rails default configuration (fixes #541)

[obrie]

This implements the solution proposed in #541

The full details of the issue can are described in that ticket. To summarize:

While secure_headers now uses lowercase headers (as required by Rack 3+), the Rails default configuration still defines non-lowercase headers. As a result, our Railtie will not remove those conflicting headers.

This change ensures that we're accounting for both lowercase and non-lowercase default headers in Rails (for current Rails defaults and future defaults).

All PRs:

• Has tests
• Documentation updated

Adding a new header

Generally, adding a new header is always OK.

• Is the header supported by any user agent? If so, which?
• What does it do?
• What are the valid values for the header?
• Where does the specification live?

Adding a new CSP directive

• Is the directive supported by any user agent? If so, which?
• What does it do?
• What are the valid values for the directive?