improve baseline HTTP security for no-reverse proxy deployment scenarios

[wojcik91]

• added baseline security headers
• HSTS only sent when the server is running with TLS
• added request body size limit
• added request timeout
• IP-based rate limiter (mirroring proxy approach)
• Cache-Control: no-store for API routes

Also forces uuid >14 frontend dependency to resolve trivy warning.

Resolves https://github.com/DefGuard/internal/issues/66

[Copilot]

Pull request overview

This PR improves DefGuard Core’s baseline HTTP hardening for deployments where Core is exposed directly (no reverse proxy), by adding security headers, request limits, and per-IP rate limiting with sensible defaults.

Changes:

• Add a centralized security-headers middleware (incl. TLS-aware HSTS) and plumb TLS state via AppState.
• Apply global request body size limits (with a larger per-route override for network import) and a global request timeout that excludes SSE streams.
• Introduce per-IP rate limiting via tower_governor, configurable via new DEFGUARD_RATELIMIT_* env vars.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/defguard_core/src/lib.rs	Adds timeout + body limits, restructures SSE routing, wires security headers middleware, and adds rate limiting in run_web_server.
crates/defguard_core/src/headers.rs	Implements security headers middleware and makes HSTS conditional on TLS.
crates/defguard_core/src/appstate.rs	Adds tls_active: Arc<AtomicBool> to app state.
crates/defguard_common/src/config.rs	Adds CLI/env config for rate limiting parameters.
crates/defguard_core/Cargo.toml	Adds tower_governor dependency.
Cargo.toml	Adds tower_governor to workspace deps and switches tower-http features to include timeout.
crates/defguard_setup/src/migration.rs	Updates AppState::new call-site with the new tls_active argument.
crates/defguard_core/tests/integration/api/common/mod.rs	Updates build_webapp call-site for new tls_active argument.
crates/defguard_core/tests/integration/api/proxy_certs.rs	Updates build_webapp call-site for new tls_active argument.
Cargo.lock	Locks new dependencies pulled in by tower_governor.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.