Add better proxy protection

User story

As a service developer for the deploy app ecosystem,

I want to not have all my paths exposed via proxy,

to avoid sensitive paths being callable without explicit knowledge

Acceptance Criteria

Outline what you think are requirements for this story to be considered Completed.
Note: a lot of this work will be in https://github.com/pvarki/opendefence-platform.

• X-Proxy-Callsign header is stripped in traefik (https://github.com/pvarki/opendefence-platform)
• Add new logic in https://github.com/pvarki/opendefence-platform to publish per-integration manifests of proxy routes, roughly in the following format

{"proxy_routes": [
  {"path": "/api/v1/clientinfo",   "methods": ["GET"],  "roles": []},
  {"path": "/api/v1/admin/*",      "methods": ["*"],    "roles": ["admin"]}
]}

• Check allowed list of proxy routes through manifest. Implicit deny if not listed.

Linked things

Link epics, features and other user stories here, if applicable.
https://pvarki.getoutline.com/doc/rasenmaeher-api-trustidentity-audit-OpE3XR3jBm

Start by reviewing the proxy integration in the linked opendefence-platform repository and the Traefik configuration referenced by the issue. Determine where per-integration proxy-route manifests and the X-Proxy-Callsign handling belong; done means the header is stripped, unlisted routes are implicitly denied, and the manifest format covers paths, methods, and roles.