[rennf93]

Closes #142

I am adding the engine side of the reference parity work so the four adapters can follow.

• guard_core_engine::path_matching: the reference exclude_paths matcher (percent-decoding for up to four rounds, \ folded to /, dot segments collapsed, a /-bounded prefix match, / excluding everything). The table in the tests is recorded from the Python reference, so /static now covers /static/app.js and /static/../admin is not excluded.
• ip_extraction: is_trusted_proxy now matches the reference (the connecting text must parse, a bare entry compares as text, a CIDR entry contains the address within its own family), so an IPv4-mapped peer no longer matches a plain IPv4 proxy entry or an IPv4 CIDR, an empty peer is no peer, and a zone-identified IPv6 literal keeps its zone. New resolve_client is the one call an adapter makes per request, including the 403 Client address could not be determined rejection under fail_secure for a peer-less request. The recorded table is in the tests.
• ResponseProcessor: process_scoped (the excluded-path pass: no return rules, headers, CORS and the modifier still run), apply_modifier (the modifier alone, for an all-checks-bypass route), needs_response_body and max_inspect_bytes, and the CORS handler headers (Vary: Origin, Access-Control-Expose-Headers) after the modifier. CorsConfig gains expose_headers.
• guard_core_rs::wiring: one SecurityConfig to pipeline mapping, so each adapter installs parts instead of mapping fields itself. The module docs carry the field-by-field table. It builds the geo country stage and handler, the cloud-provider stage with the interval-driven refresh, the limiter with endpoint_rate_limits and the auto-ban flag, the ban manager and the HTTPS stage with the configured trusted proxies, the custom request check and auth verifier stages, the response pass with the modifier and on_error, the Redis stores behind the redis feature, and the event bus, metrics collector and dynamic-rule driver over an injected agent.

The adapter PRs (tower, axum, actix, rocket) depend on this API: their CI checks out the engine master as the sibling, so they stay red until this merges. Merge order: this PR, then tower, then axum (it composes tower), then actix and rocket in any order.

Gates run locally: fmt, clippy (workspace, all targets, and the PyO3 crate with all features) with -D warnings, the pattern-probe child build, the workspace tests including the three conformance gates, cargo doc with -D warnings, the MSRV 1.92 check and tests, and the 100% line coverage gate. The Redis arm of the wiring compiles and passes its own tests with --features redis but is outside the default coverage build, like the rest of redis_store. One local flake showed up while I ran the coverage gate on macOS: the cloud_fetch stub tests (a stub server can read the request before the client wrote it) failed a different test in each of three consecutive runs, and the runs after that passed, including the final 100% gate and the MSRV test run.