[功能请求] 为服务端插件添加 HTTP 请求准入操作

Feature request

NewUserConn observes connections, while the HTTP reverse proxy may reuse backend connections. It therefore cannot reliably make an admission decision for every HTTP request. Add a read-only NewHTTPRequest server-plugin operation. Invoke it for every request after Host/Location routing and route HTTP Basic Auth succeed, but before acquiring a backend work connection or forwarding the request. Every request on an HTTP keep-alive connection must trigger it independently. Keep the initial payload minimal and unambiguous:

{
  "remote_addr": "203.0.113.10:52130",
  "host": "app.example.com",
  "method": "GET",
  "uri": "/api/orders",
  "route_domain": "app.example.com",
  "route_location": "/api"
}

uri contains only the URL path, not the query. The initial version does not send the body, cookies, Authorization, Proxy-Authorization, or arbitrary headers. A load-balanced route has not selected its final backend proxy at this stage, so the payload also omits potentially incorrect user and proxy_name values. The operation supports admission only. reject=true stops the plugin chain and returns a fixed HTTP 403 without exposing the rejection reason. Returned content is ignored for allowed requests and cannot mutate the forwarded request. The plugin call inherits cancellation from the incoming request, but this proposal adds no hard-coded or configurable timeout. When the operation is not configured, no request-check callback is installed. Existing configuration, control protocol, and forwarding behavior remain unchanged, with only a nil callback check in the request path.

Validation scope

Tests cover plugin management, configuration validation, GET and CONNECT, authentication ordering, zero backend access after rejection, a real frps/frpc/plugin/backend E2E flow, race checks, and a disabled-path benchmark. The change is self-contained and contains no business logic, throttling, caching, or asynchronous calls.