fetch: every outbound request carries one generic browser User-Agent

Stripping forwarding headers kept our IP and chain out of reach, but the
User-Agent went through untouched. Clients that fell back to their own name
("crawlkit-roles", "crawlkit-virk", ...) tied all ten exits together as one
actor, and one missing UA meant Go-http-client. The proxy now overwrites the
UA on every request (WEIRCON_USER_AGENT, default current Firefox) and the
egress prober uses the same string.

Also dropped: From, Sec-Ch-Ua* (would contradict a Firefox UA) and any
X-Weircon-* by prefix. New end-to-end test drives the whole handler and
checks what the target actually receives.

Claude-Session: https://claude.ai/code/session_01AUj1LSMmrowcomkn1ciAgj

lxc/fetch.env.example

@@ -32,3 +32,8 @@ WEIRCON_DRAIN_MAX_HOLD_SEC=60
 WEIRCON_PROBE_URL=https://api.ipify.org
 WEIRCON_PROBE_INTERVAL_SEC=60
 WEIRCON_PROBE_TIMEOUT_SEC=10
+
+# User-Agent som ALLE udgående kald får, uanset hvad klienten sendte (også
+# proberen). Tom/udeladt = indbygget aktuel Firefox. Opdatér med jævne mellemrum;
+# en årgammel browserversion er i sig selv et bot-tegn.
+#WEIRCON_USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0