feat: scoped cf-access-token header for internal endpoints

[HenriqueSFernandes]

Add optional Cloudflare Access support via the MACH_CF_ACCESS_TOKEN env var.
When set, mach attaches a redacted cf-access-token header to test requests, scoped to speed.cloudflare.com with strict domain-label matching so it never leaks to unrelated origins.

Closes #43

[Copilot]

Pull request overview

Adds optional Cloudflare Access support to mach by introducing a scoped-header mechanism that attaches a sensitive cf-access-token header only to requests whose host matches an allowlisted domain suffix (intended to prevent token leakage to unrelated origins).

Changes:

• Introduces nq_core::ScopedHeaders and integrates it into core HTTP clients so headers can be conditionally applied per-request based on the URI host.
• Threads scoped_headers through load-generation and multiple test paths (rpm/responsiveness, packet loss, latency, download/upload, saturate).
• Adds CLI plumbing to read MACH_CF_ACCESS_TOKEN, mark it sensitive for log redaction, and document the feature in the README.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents Cloudflare-internal Access-token support and scoping guarantees.
crates/nq-rpm/src/lib.rs	Adds optional scoped_headers to responsiveness config and applies it to probe requests.
crates/nq-packetloss/src/lib.rs	Adds scoped_headers to packet loss config and passes it into load generation.
crates/nq-load-generator/src/lib.rs	Carries scoped_headers through LoadConfig/LoadGenerator and applies them to throughput requests.
crates/nq-latency/src/lib.rs	Applies scoped_headers directly to the latency (RTT) request headers.
crates/nq-core/src/scoped_headers.rs	New core utility implementing host-suffix scoping for header attachment.
crates/nq-core/src/lib.rs	Exposes the new ScopedHeaders type from nq-core.
crates/nq-core/src/client.rs	Adds scoped-header support to ThroughputClient and Client request construction.
cli/src/up_down.rs	Applies optional Access scoped headers to download/upload subcommands.
cli/src/saturate.rs	Passes optional Access scoped headers into the saturate/rpm config path.
cli/src/rpm.rs	Fetches rpm config using optional scoped headers and propagates them into subsequent tests.
cli/src/packet_loss.rs	Passes optional scoped headers into packet-loss flows and TURN-cred fetch.
cli/src/main.rs	Registers the new access module.
cli/src/latency.rs	Applies optional scoped headers to the latency subcommand.
cli/src/access.rs	New CLI helper to build ScopedHeaders from MACH_CF_ACCESS_TOKEN with sensitivity redaction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.