✅ e2e mock: add AppSec scenario + custom remediation header assertion

Address review feedback on the binary e2e suite:

- mocklapi: add an AppSec WAF stand-in (--appsec-addr) that blocks any URI
  containing "rpc2" — the exact probe from examples/appsec-enabled — and allows
  the rest. Lets the suite exercise the plugin's AppSec wiring (header
  forwarding + allow/block enforcement) without the real CRS engine.
- new scenarios/appsec: benign request passes, /foo/rpc2 is 403.
- custom-ban-page: assert the banned response carries the custom remediation
  header (remediationHeadersCustomName), per review.
- README: drop the "don't open issues / AppSec intentionally absent" framing;
  describe what the suite actually covers, including AppSec wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/e2e/mock/scenarios/custom-ban-page/dynamic.yml

@@ -25,3 +25,4 @@ http:
           forwardedHeadersTrustedIps:
             - "127.0.0.1/32"
           banHtmlFilePath: "@@SCENARIO_DIR@@/ban.html"
+          remediationHeadersCustomName: "X-E2E-Remediation"

tests/e2e/mock/scenarios/custom-ban-page/run.sh

@@ -19,6 +19,9 @@ body() {
 
   echo "[$SCENARIO] banned response body contains the custom marker"
   assert_body_contains "http://127.0.0.1:${WEB_PORT}/foo" "E2E_CUSTOM_BAN_PAGE_MARKER" -H "X-Forwarded-For: 1.2.3.4"
+
+  echo "[$SCENARIO] banned response carries the custom remediation header (remediationHeadersCustomName)"
+  assert_header "http://127.0.0.1:${WEB_PORT}/foo" X-E2E-Remediation "ban" -H "X-Forwarded-For: 1.2.3.4"
 }
 
 run_scenario "$SCENARIO" "$HERE" body