Privilege escalation via retained client identity headers

Improper authentication in Caddy 2.10.0 through 2.11.1 allows remote authenticated users to inject trusted identity headers. The forward_auth copy_headers route conditionally sets a header only when the authentication service returns it, but never deletes the same client-supplied header. A valid low-privilege token and a deployment whose authentication service omits a configured identity header are required; the backend then accepts attacker-chosen identity or role values, enabling privilege escalation.