v1.6 — Production fixes

What's changed

• Fixed: www no longer stripped from canonical host
• Fixed: is_ssl() instead of $_SERVER['HTTPS'] — works behind Cloudflare
• Fixed: scheme taken from home_url() — not hardcoded
• Fixed: query string passes through unmodified
• Added: extensible skip list via url_normalizer_skip_prefixes filter
• Added: opt-out for path lowercasing via url_normalizer_lowercase_path filter
• Added: host mismatch guard against Host header injection
• Added: user_trailingslashit() — respects WordPress permalink settings
• Updated: license changed to GPL-2.0-or-later