JT REST API Cache Poisoning Fix

Prevents cache poisoning attacks via attacker-controlled override and host headers, and restricts REST API endpoint exposure. This plugin mitigates a class of cache poisoning vulnerabilities where attackers can send special HTTP headers to cause empty, altered, or attacker-influenced responses to be cached by upstream caching layers (like Pagely ARES), breaking the site for legitimate users or feeding poisoned content (canonical URLs, password-reset emails, RSS feeds) to other visitors. What it does: Rejects requests with method-override or URL-rewrite headers immediately with 400 Bad Request Silently strips host-poisoning headers (X-Forwarded-Host etc.) so WordPress falls back to the real Host header Returns aggressive no-cache headers to prevent upstream cache poisoning of error responses Blocks method parameter-based method overrides (used by some frameworks) Adds Vary headers to REST API responses for cache key differentiation Includes Pagely ARES-specific headers (X-Accel-Expires, Surrogate-Control) Logs blocked attempts when WPDEBUG is enabled Auto-updates from GitHub releases (no WordPress.org dependency) Headers rejected (HTTP 400): X-HTTP-Method-Override X-H