fix(req): normalize forwarded protocol casing

[lin-hongkuan]

This normalizes trusted X-Forwarded-Proto values to lowercase before exposing req.protocol, so req.secure handles HTTPS the same as https.

The regression tests cover both req.protocol and req.secure with uppercase forwarded protocol input.

Validation:

• npx mocha --require test/support/env --check-leaks test/req.protocol.js test/req.secure.js
• npm run lint
• git diff --check

AI-assisted: Codex helped prepare this focused change; I reviewed the diff and ran the validation above before submitting.