Fix WebSocket header handling and tighten update archive checks

[ryanfowler]

Summary

• Preserve duplicate WebSocket handshake headers while still replacing generated defaults
• Harden Windows update archive path validation against trailing-space and trailing-dot normalization
• Add unit coverage for both behavior changes

Testing

• cargo test --all-features websocket_request_preserves_duplicate_cli_headers_and_replaces_defaults
• cargo test --all-features test_unpack_zip_artifact_path_traversal
• cargo clippy --locked --all-targets --all-features -- -D warnings