Summary by cubic

Sanitizes request header values by stripping invalid bytes and trimming tabs/spaces instead of throwing, preventing header injection across browser and Node. Also hardens proxy bypass by treating localhost, 127.0.0.1, and ::1 as equivalent loopbacks in NO_PROXY matching.

Description

• Replace validation with sanitization in AxiosHeaders; remove disallowed bytes, trim SP/HTAB, handle strings and arrays; no throws.
• Prevent creation of new headers from injected content.
• Harden shouldBypassProxy: treat localhost, 127.0.0.1, and ::1 as equivalent loopbacks in NO_PROXY matching.

Testing

• Browser adapter: header '\tok\r\nInjected: yes ' becomes 'okInjected: yes'; no Injected header.
• Node fetch and http adapters: echo servers confirm same sanitized value and no extra headers.
• AxiosHeaders and shouldBypassProxy tests updated: expect sanitized string/array values; verify loopback equivalence across localhost/127.0.0.1/::1.

^{Written for commit 98799bf. Summary will update on new commits.}