secure v2.0.0rc1: presets redesign, ASGI/WSGI middleware, and header updates

[cak]

This PR prepares the v2.0.0rc1 release of secure, delivering a redesigned preset model, first-class ASGI/WSGI middleware, updated header directives, and a safer, more explicit header application pipeline.

Summary

• Introduces Preset.BALANCED as the new recommended default.
• Redefines Secure.with_default_headers() to map to Preset.BALANCED.
• Adds framework-agnostic ASGI and WSGI middleware.
• Expands the public API with header allowlisting, deduplication, and validation helpers.
• Refreshes documentation with clearer defaults, migration guidance, and error handling.

Breaking changes

• Presets redesigned:
  • Added Preset.BALANCED (new default).
  • Preset.BASIC targets Helmet.js parity.
  • Preset.STRICT no longer enables HSTS preload by default.
• Secure.headers is now strict about duplicate header names (case-insensitive).
  • Use header_items() for multi-valued output or resolve duplicates via the pipeline helpers.

Added

• SecureASGIMiddleware and SecureWSGIMiddleware (re-exported via secure.middleware).
• Header pipeline helpers:
  • allowlist_headers(...)
  • deduplicate_headers(...)
  • validate_and_normalize_headers(...)
• Explicit multi-value serialization via header_items().
• New constants and policy types: MULTI_OK, COMMA_JOIN_OK, DEFAULT_ALLOWED_HEADERS, and related policy enums.
• Expanded built-in header coverage (CORP, X-DNS-Prefetch-Control, X-Permitted-Cross-Domain-Policies).
• Project governance files and CI improvements.

Documentation

• README rewritten into a full integration guide.
• Detailed preset documentation (BALANCED, BASIC, STRICT).
• New middleware, validation pipeline, and error-handling sections.
• Supported frameworks list expanded (now includes Dash and Shiny).
• Explicit attribution to MDN and the OWASP Secure Headers Project.

Testing & tooling

• Expanded unit and contract tests.
• Improved sync/async response integration coverage.
• Modernized pyproject.toml and Ruff configuration.

Fixes

• Fixes Potential Thread-Safety Concern with @cached_property Usage #38 – Potential thread-safety concern with @cached_property usage
• Fixes Potential Asynchronous Context Confusion in set_headers #37 – Potential asynchronous context confusion in set_headers
• Fixes Lack of Duplicate Header Detection in Secure Class #36 – Lack of duplicate header detection in Secure class
• Fixes Lack of Allowlisting for Header Names in Secure Class #35 – Lack of allowlisting for header names in Secure class
• Fixes Missing Error Handling in set_headers and set_headers_async #34 – Missing error handling in set_headers and set_headers_async
• Fixes Lack of Input Validation on Header Names and Values #33 – Lack of input validation on header names and values
• Fixes AttributeError: 'Secure' object has no attribute 'hsts' #32 – AttributeError: 'Secure' object has no attribute 'hsts'
• Fixes PermissionsPolicy missing some permissions #29 – PermissionsPolicy missing some permissions

This is a release candidate. Feedback on preset defaults, middleware ergonomics, and the validation pipeline is especially welcome before the final v2.0.0 release.