feat(api): forward DUO_WORKFLOW_WORKFLOW_ID as X-Gitlab-Duo-Workflow-Id header

Summary

• Adds DUO_WORKFLOW_WORKFLOW_ID → X-Gitlab-Duo-Workflow-Id header so the API server can correlate CLI traffic back to the originating workflow
• DUO_WORKFLOW_WORKFLOW_ID is set by GitLab's Workflow service (see start_workflow_service.rb#L209)
• Uses a dedicated header (X-Gitlab-Duo-Workflow-Id) that accurately reflects the semantic of the env var, rather than piggybacking on X-Gitlab-Duo-Session-Id
• Same malformed-input guard (CR/LF/NUL) applied — skip the header entirely rather than sending a mangled value
• Also removes GITLAB_DUO_SESSION_ID / X-Gitlab-Duo-Session-Id support added in !3361 (merged), which is superseded by this dedicated header

Test plan

• DUO_WORKFLOW_WORKFLOW_ID set → X-Gitlab-Duo-Workflow-Id header forwarded
• DUO_WORKFLOW_WORKFLOW_ID empty → no header
• DUO_WORKFLOW_WORKFLOW_ID set via env overrides same header from config
• Malformed DUO_WORKFLOW_WORKFLOW_ID (CR/LF/NUL) → no header

🤖 Generated with Claude Code