Request had no tests despite being the front door for all HTTP input. Built
from injected arrays (no superglobals), the new suite locks:
- GET/POST merge precedence (POST wins), input/get/post/has/all accessors and
their defaults.
- Typed accessors: getInt() coercion, getBool() via FILTER_VALIDATE_BOOLEAN.
- Server-derived helpers: method/isPost/isAjax/uri/userAgent/host (with the
HTTP_HOST -> SERVER_NAME fallback) and their empty-server defaults.
- Client IP resolution: first valid X-Forwarded-For entry, skipping invalid
headers to X-Real-IP, and the 0.0.0.0 sentinel when nothing is usable.
- Security sanitizers (the important part): NUL-byte stripping, ../ traversal
neutralisation, <script>/<!-- --> defusing, stripslashes, CRLF normalisation,
key scrubbing (__x__ / double-dot / htmlspecialchars), and recursive in-place
cleanGlobals().
+13 tests, 57 assertions. Suite: 608 tests, 0 errors.
