Apply reserved-header handling on the request-clone path and cover all X-MS-TOKEN- headers

[iNinja]

Makes reserved-header handling consistent across the DownstreamApi code paths.

• MicrosoftIdentityMessageHandler clones the outgoing request for challenge retries and mTLS PoP. The clone now applies the same reserved-header filter already used for ExtraHeaderParameters, so reserved headers are handled the same way on every path.
• Broadens the reserved X-MS-TOKEN- prefix to cover the whole X-MS-TOKEN-* family rather than only X-MS-TOKEN-AAD-*.

ReservedHeaderNames moves to Microsoft.Identity.Web.TokenAcquisition so both it and the DownstreamApi layer share a single definition. It stays internal; no public API change.

Tests: added coverage for IsReserved classification, the clone path (reserved and Authorization headers are not copied, ordinary headers are), and the additional ExtraHeaderParameters prefix cases. Affected suites pass on net8.0.

[Copilot]

Pull request overview

This PR makes reserved-header handling consistent across DownstreamApi request construction and the MicrosoftIdentityMessageHandler request-clone path (used for challenge retries and mTLS PoP). It also broadens the reserved X-MS-TOKEN- prefix so that all X-MS-TOKEN-* headers are treated as reserved (not only X-MS-TOKEN-AAD-*), and adds test coverage for the new behavior.

Changes:

• Broaden reserved-header prefix matching from X-MS-TOKEN-AAD- to X-MS-TOKEN- in ReservedHeaderNames.
• Apply reserved-header filtering when cloning outgoing requests in MicrosoftIdentityMessageHandler.CloneHttpRequestMessageAsync.
• Add/extend unit tests to validate reserved-header classification and clone behavior; document the change in the changelog.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/Microsoft.Identity.Web.Test/ReservedHeaderCloneTests.cs	Adds unit tests for reserved-header classification and verifies reserved headers are dropped during request cloning.
tests/Microsoft.Identity.Web.Test/DownstreamWebApiSupport/DownstreamApiTests.cs	Extends ExtraHeaderParameters reserved-prefix tests to cover non-AAD X-MS-TOKEN-* headers.
src/Microsoft.Identity.Web.TokenAcquisition/ReservedHeaderNames.cs	Broadens reserved prefix matching to cover the full X-MS-TOKEN-* family.
src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs	Ensures cloned requests do not carry over reserved headers (consistent with ExtraHeaderParameters handling).
changelog.md	Adds a bug-fix entry describing the reserved-header and clone-path behavior change.