perf(router): use leaner security header lookups

Use null-returning Headers.get checks instead of Headers.has before applying defaults, preserving empty and custom caller values.\n\nA 500k-iteration median improved the default triad from 609 ns to 562 ns. In the live profile, native has self-time dropped from 6.6% to 0.3% while combined has/get lookup share fell from 10.4% to 7.5%. The shared-machine HTTP total was noisy and is not used as evidence.\n\nValidated with security and hot-path tests, framework type checks, and pickier lint.

Author: chrisbbreuer

storage/framework/core/router/src/security-headers.ts

@@ -82,20 +82,20 @@ export function applySecurityHeaders(headers: Headers): void {
   if (isDisabled())
     return
 
-  if (!headers.has('X-Content-Type-Options'))
+  if (headers.get('X-Content-Type-Options') === null)
     headers.set('X-Content-Type-Options', 'nosniff')
 
-  if (!headers.has('X-Frame-Options'))
+  if (headers.get('X-Frame-Options') === null)
     headers.set('X-Frame-Options', 'SAMEORIGIN')
 
-  if (!headers.has('Referrer-Policy'))
+  if (headers.get('Referrer-Policy') === null)
     headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
 
-  if (isProduction() && !headers.has('Strict-Transport-Security'))
+  if (isProduction() && headers.get('Strict-Transport-Security') === null)
     headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
 
   const csp = resolveCsp()
-  if (csp && !headers.has(csp.header))
+  if (csp && headers.get(csp.header) === null)
     headers.set(csp.header, csp.value)
 }