ROOT_PATH_SKIP_PREFIXES - trailing-slash prefix silently disables the skip, plus two sub-path-upstream edge cases

Sorry I was too slow to comment on #198 before it got merged, so opening this issue. The current version works well for its main use case (on a shared hostname). But when reviewing the final merged version of the PR, I found that the last commits may have introduced (or re-exposed) some edge cases where links come out wrong. The 1st can affect anyone using the middleware programmatically I think, the other two only trigger with an upstream URL mounted under a sub-path (e.g. `UPSTREAM_URL=http://upstream/api`).

I asked Claude to generate a minimalist example about them below so it is clearer:

## 1. A trailing slash in a prefix silently disables the skip

`ProcessLinksMiddleware` is exported from `stac_auth_proxy.middleware`, and it no longer normalizes its own prefixes (that now only happens in the `Settings` env-var validator). So constructing the middleware directly with a trailing slash:

```python
ProcessLinksMiddleware(..., root_path="/stac", root_path_skip_prefixes=["/raster/"])
```

produces a prefix that matches nothing (no error, no warning). Concretely, for a link that the skip list is supposed to protect:

```
input link: http://proxy.example.com/raster/tiles (a link to the tiler app)
expected: http://proxy.example.com/raster/tiles (left alone — the whole point of the skip list)
actual v1.2.0: http://proxy.example.com/stac/raster/tiles (ROOT_PATH added anyway → broken link)
```

## 2. Two related edge cases when the upstream URL has a path

Both need `UPSTREAM_URL` mounted under a sub-path (e.g. `http://upstream/api`) *and* a name collision with a skip prefix (I agree it is a rare combination but I thought it is still maybe worth tracking this issue?).

**a. Prefix string-collision with the upstream path mangles the link.** E.g:

```python
ProcessLinksMiddleware(
...,
upstream_url="http://upstream.example.com/api",
root_path="/stac",
root_path_skip_prefixes=["/api-docs"],
)
```
leads to

```
input link: http://proxy.example.com/api-docs/foo (a link to the docs app on the public host)
expected: http://proxy.example.com/api-docs/foo (matches skip prefix /api-docs — left alone)
actual v1.2.0: http://proxy.example.com/stac-docs/foo (mistaken for upstream-internal: "/api" stripped, ROOT_PATH glued on → mangled)
```

**b. An upstream route that looks like a skip prefix loses ROOT_PATH.**

```python
ProcessLinksMiddleware(
...,
upstream_url="http://upstream.example.com/api",
root_path="/stac",
root_path_skip_prefixes=["/raster"],
)
```

leads to

```
input link: http://upstream.example.com/api/raster/tiles (a real endpoint inside the upstream API)
expected: http://proxy.example.com/stac/raster/tiles (public URL, routed back through the proxy)
actual v1.2.0: http://proxy.example.com/raster/tiles (path stripped before the skip check → matches /raster → points at the tiler app instead)
```

Start in stac_auth_proxy.middleware at ProcessLinksMiddleware, then check the Settings environment-variable validator for the prefix normalization behavior. Reproduce the three examples in the issue, including a trailing-slash skip prefix and an upstream URL mounted at /api; done means each link matches its stated expected result.

Written by the indexing model from the issue text.