fix: exclude Transfer-Encoding header during page cloning to prevent …

[Ricardo08S]

Problem

When SNARE clones a target page that responds with Transfer-Encoding: chunked
(common for sites behind CDNs/proxies such as Cloudflare), the cloner stores
this header verbatim in meta.json. When SNARE later serves the cloned page,
it replays this header as-is, while aiohttp independently determines the
actual transfer encoding of the served body (since SNARE serves static cloned
content, not a real chunked stream).

This results in a response that advertises Transfer-Encoding: chunked but
whose body is not actually formatted as valid HTTP chunks, producing a
response that's invalid per RFC 7230. Strict HTTP clients (e.g. curl 8.x)
reject this outright:

curl: (56) Illegal or missing hexadecimal sequence in chunked-encoding

Root cause

Cloner.get_headers() already excludes several headers known to cause
conflicts when replayed by a different server (content-length,
content-encoding, cache-control, etc.), but transfer-encoding was
missing from this list. Since SNARE does not actually replay the original
chunked stream byte-for-byte, it should not advertise a transfer encoding
that depends on implementation details of the origin server.

Reproduction

1. Clone any page that responds with Transfer-Encoding: chunked (e.g. a
   domain proxied through Cloudflare):

   clone --target https://example.com --path /opt/snare/pages

2. Run SNARE serving that page directory.

3. curl -v http://127.0.0.1

4. Observe both Content-Length (added by aiohttp) and Transfer-Encoding: chunked (replayed from meta.json) present in the response simultaneously
   — an invalid combination per RFC 7230 §3.3.3 — and curl fails to parse the
   body as valid chunked data.

Fix

Add transfer-encoding to ignored_headers_lowercase in cloner.py, the
same way content-length and content-encoding are already excluded for
analogous reasons.

Testing

• Cloned a Cloudflare-proxied page before and after the fix.
• Before: curl fails with Illegal or missing hexadecimal sequence in chunked-encoding.
• After: response served correctly with a valid Content-Length-based
  response, full body delivered intact.