feat: pure-ASGI security middleware (no BaseHTTPMiddleware) #157

Framework projects that ban BaseHTTPMiddleware (open-webui bans it in main.py with a written rationale: the anyio task group cancels in-flight downstream DB calls on client disconnect) currently cannot adopt guard at all.

Requested: a pure-ASGI variant of SecurityMiddleware running the identical screening pipeline without BaseHTTPMiddleware, with body replay for the downstream app and header injection directly on http.response.start.

Delivered by #156.