fix: reject authorization in every quirk header field

[TheGreatAxios]

Closes CL-9433

Follow-up to CL-9425, which only covered headers.static.

• headers.modelHeader, headers.fromOption[].header and sessionIdHeader are now lowercased when quirks are parsed, the same as headers.static.
• Setting any of the four to authorization, in any case, throws invalid quirks: <field> must not set authorization. Before, fromOption or sessionIdHeader let a caller's providerOptions replace the credential sentinel.

Unit tests cover each field in lowercase and capitalised form, plus lowercasing of the three dynamic header names.