release(4.4.0): scan budget, Cookie pair scanning, dynamic rule overlay #170

Value this delivers

Users get the Cookie header fix, the per-request scan CPU budget, the semantic-only header opt-out and the dynamic rule overlay fix in a published guard-core release.

Context

Release prep for 4.4.0: everything merged on master since v4.3.3 (#162, #163, #165, #167, #169 and the repo chores).