fix(appsec): lowercase downstream request headers for WAF (#4367)

Fixes: APPSEC-60804

Author: RomainMuller

internal/appsec/listener/httpsec/roundtripper.go

@@ -71,7 +71,7 @@ func (feature *DownwardRequestFeature) OnStart(op *httpsec.RoundTripOperation, a
 	builder := addresses.NewAddressesBuilder().
 		WithDownwardURL(args.URL).
 		WithDownwardMethod(args.Method).
-		WithDownwardRequestHeaders(args.Headers)
+		WithDownwardRequestHeaders(headersToLower(args.Headers))
 
 	// Increment the span metric for downward requests
 	op.HandlerOp.ContextOperation.GetMetricsInstance().SumDownstreamRequestsCalls.Add(1)

internal/appsec/testdata/api10.json

@@ -413,7 +413,7 @@
               {
                 "address": "server.io.net.request.headers",
                 "key_path": [
-                  "Witness"
+                  "witness"
                 ]
               }
             ],