fix(attach-consumer-label): always drop client-supplied configured headers

[shreemaan-abhishek]

Description

The attach-consumer-label plugin sets configured headers (e.g. X-Consumer-Role: $role) from the authenticated consumer's labels so Upstream services can rely on the gateway-set value. It is meant to overwrite any value a client sent for those header names, so the Upstream only ever sees the gateway-set value.

Today that overwrite only happens when the consumer has a non-empty labels map. before_proxy returns early when ctx.consumer is absent or ctx.consumer.labels is nil, so a client-supplied value of a configured header (e.g. an inbound X-Consumer-Role) is forwarded to the Upstream unchanged instead of being cleared.

labels is optional, and a consumer created without it stores no labels field at all, i.e. nil — this is the default, common state. A consumer that was created with labels and later updated without them also ends up with labels = nil. Both cases hit the early return and skip the overwrite. (A consumer that has labels is unaffected even when the referenced key is missing, because the loop then sets the header to nil.) So the gap applies to the ordinary no-labels population, not a rare edge case.

This change clears every configured header name when the consumer has no labels, so the Upstream only ever sees the gateway-set value. When the consumer has labels, the existing set loop already overwrites any client-supplied value, so a single pass suffices. This matches the existing behavior of sibling plugins such as forward-auth, opa, and openid-connect, which clear their managed headers.

An end-to-end test case (TEST 16/17) is added: it authenticates a consumer that has no labels, sends a client-supplied copy of a configured header, and asserts via /print_request_received that the header is absent from what the Upstream actually receives. It fails before this change and passes after. Docs are updated to state that a client-supplied value of a configured header is always removed first.

Which issue(s) this PR fixes:

Fixes #

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)