test: Add unit tests for middleware

[Vishmayraj]

internal/middleware had no test coverage. This PR adds tests for:

SecurityHeaders: verifies all 7 security headers are set with correct
values, and that the next handler is called correctly.

CachedPromHandler: verifies empty cache fallback, correct Content-Type
when cache is populated, and concurrent read safety (verified with -race).

SentryMiddleware is intentionally skipped — it wraps a third-party SDK
with no testable surface without mocking Sentry internals.

All existing tests continue to pass.