Apply security headers to Workers auth error responses

[nedtwigg]

The successful security audit found that failures outside the inner auth app returned a 503 with only Cache-Control: no-store. For example, an HTTP APP_ORIGIN or a throwing email factory omitted the referrer policy, content-type protection, frame protection, and CSP. The diagnostics wrapper's fallback had the same gap.

Extract the existing auth security-header middleware and apply it to the outer Worker app as well. This covers setup and teardown failures and diagnostics-generated responses with the same policy used by normal auth responses. Update SECURITY.md to explicitly include these fallback responses.

Validation:

• All 91 tests in the unit and Better Auth integration suites passed, including the production Worker bundle in workerd.
• Four new regression cases cover setup failures with diagnostics enabled and disabled; all four reproduced the missing headers before the fix.
• Type-checking, formatting checks, and git diff --check passed.