Workers, BYOIP, Bots - Workers subrequests now preserve context for BYOIP destinations

Summary

• Workers subrequests to BYOIP destinations now retain the CF-Worker header and cf.worker.upstream_zone, preserving original client context.
• Bot Management fields and security rule evaluation now reflect the end‑user connection instead of internal Cloudflare traffic.
• Cross‑zone subrequests set CF-Connecting-IP to the original client IP for security, while same‑zone requests keep existing behavior.