Add scheme matcher for routing on TLS state

[tigerwill90]

Summary

Adds a new built-in matcher to the existing list (alongside header, query, client IP) for routing on the request scheme.

The match is derived from r.TLS only. We deliberately don't look at r.URL.Scheme because Go populates it from the request-line, which a client can set to anything via the HTTP/1.1 absolute-form (RFC 7230 §5.3.2). For example, sending GET https://anything/path HTTP/1.1 over plain TCP is a valid request that lands on the server with r.URL.Scheme == "https" while r.TLS == nil. Same reasoning for X-Forwarded-Proto: it can be spoofed unless the application validates it within a trust boundary (e.g. trusted proxy list). When that's needed, users can write their own Matcher and decide where the trust comes from.

Example

f.Add(fox.MethodGet, "/admin", adminHandler, fox.WithSchemeMatcher("https"))

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!