feat: expose rule regex captures to rewriters

[houyuwushang]

Description

Adds regex capture expansion to Rule Router request rewriters. An rmatch rule now exposes ${0}, numbered submatches such as ${1}, and named submatches such as ${tenant} to the matched case rewriter and that rule's egress rewriter. Captures are request-scoped and cleared before the next route.

The change also makes explicit scheme, host, hostname, and port rewrites apply to the final upstream URL. Because a captured hostname can select a different origin, the final rewritten authority participates in cache identity to prevent responses from different origins sharing an entry.

Existing rules without token-bearing rewriters do not calculate capture maps. Undefined tokens remain unchanged, optional unmatched captures expand to an empty string, and expansion is non-recursive. The documentation includes the decoded-path behavior from the original example and warns that client-derived authorities require restrictive regular expressions because configured credentials follow the selected origin.

Fixes #598.

Validation

• go test -count=20 ./pkg/backends/rule ./pkg/proxy/request/rewriter
• go test -race -count=5 ./pkg/backends/rule ./pkg/proxy/request/rewriter
• go test -count=1 ./pkg/backends/... ./pkg/proxy/...
• go vet ./pkg/backends/... ./pkg/proxy/...
• go tool golangci-lint run --timeout 5m -c .golangci.yml ./pkg/backends/rule/... ./pkg/proxy/request/rewriter/... ./pkg/proxy/urls/... ./pkg/proxy/engines/...
• Linux/amd64 compile-only checks for the changed Rule, rewriter, URL, and engine packages

Type of Change

• Bug fix
• New feature
• Optimization
• Test coverage
• Documentation
• Infrastructure

AI Disclosure

• This contribution DOES NOT include AI-generated changes
• This contribution DOES include AI-generated changes, and I have reviewed the relevant contributing guidelines.