bug: multi headers failed to match the deny_list

[Arjen10]

Current Behavior

the ua-restriction plugin can't handle multi headers match the deny list

Expected Behavior

[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://xxxx:9080/fake222 -H 'User-Agent: my-bot1'
403
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://xxxx:9080/fake222 -H 'User-Agent: Mozilla' -H 'User-Agent: Chrome'
200
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://xxxx:9080/fake222 -H 'User-Agent: Mozilla'
200

Error Logs

[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222 -H 'User-Agent: my-bot1'
403
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222 -H 'User-Agent: Mozilla' -H 'User-Agent: Chrome'
403
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222 -H 'User-Agent: Mozilla'
200

Steps to Reproduce

1、set up a fake HTTP API

location /fake {
        content_by_lua_block {
            if ngx.var.arg_fmt == "xml" then
                ngx.header["Content-Type"] = "text/xml"
                ngx.say("<root><foo>from-xml</foo></root>")
                return
            end
            
            ngx.header["Content-Type"] = "application/json"
            ngx.say("{\"root\": \"from-json\" }")
            return
        }
    }

2、creat a router

curl --location --request PUT 'http://172.18.0.21:9180/apisix/admin/routes/2222' \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: xxxx' \
--data '{
    "uri": "/fake222",
    "plugins": {
      "ua-restriction": {
        "bypass_missing": false,
        "denylist": [
          "my-bot1"
        ],
        "message": "Access denied"
      }
    },
    "upstream": {
        "type": "roundrobin",
        "scheme": "https",
        "pass_host": "node",
        "nodes": {
            "xxx:6443": 1
        }
    }
}'

3、send req

[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222   -H 'User-Agent: my-bot1'
403 good
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222   -H 'User-Agent: Mozilla' -H 'User-Agent: Chrome'
403 erro
[root@svr-ghsgis ~]# curl -s -o /dev/null -w "%{http_code}\n" http://172.18.0.21:9080/fake222   -H 'User-Agent: Mozilla'
200 good

Environment

• APISIX version (run apisix version): 3.18.0