Wide Default, Narrow Doc

A forwarding component copies its entire inbound structure into its outbound call by default. The component's reference documentation enumerates the configurable surface and is silent about the rest. Operators reason from the narrow description; the wide default ships their inbound credentials, cookies, and headers across the service boundary unannounced. The fix is an opt-in allowlist, and the same commit adds the documentation paragraph that finally describes the default. The wide forwarding remains the default.