protect nginx temp directories from purge walks - #66

This patch adds a safety mechanism to prevent purge walks (purge_all,
wildcard, and vary‑aware exact purges) from deleting files inside
Nginx's own temporary directories.

The problem:

• Nginx's documented best practice is to put *_temp_path and *_cache_path
  on the same filesystem for atomic rename().
• This is frequently (mis)implemented as nesting *_temp_path under
  *_cache_path, e.g.:
  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=z:10m;
  proxy_temp_path /var/cache/nginx/proxy_temp;
• In that layout, a purge walk starting from /var/cache/nginx descends
  into proxy_temp and deletes in‑flight temporary files, corrupting
  responses and causing hard‑to‑debug errors under load.

The solution:

• Hard‑code the default basenames of nginx's temp directories:
  client_temp, client_body_temp, fastcgi_temp, proxy_temp, scgi_temp,
  uwsgi_temp.
• Add a pre_tree_handler that returns NGX_DECLINED for any directory
  whose path component exactly matches one of these names, causing
  ngx_walk_tree() to skip that entire subtree.
• Add a per‑file check in every delete handler (purge_all, partial,
  exact) as a fallback, ensuring protection even on older nginx
  versions that don't support directory skipping.

The list is intentionally static and name‑based rather than read from
live *_temp_path directives, because the purge walk runs long after
configuration parsing, with no cheap way to retrieve every protocol's
temp_path at that time. These names are Nginx's compiled‑in defaults
and cover the overwhelming majority of real‑world installations.

This guard is a pure safety net: it only ever causes files to be
SKIPPED, never causes a file that would otherwise be left alone to be
deleted.