OpenWAF Egress 0.2.2

OpenWAF Egress 0.2.2 is out (ghcr.io/openwaf-dev/egress:0.2.2, linux/amd64 and linux/arm64). It hardens the gateway:

Bearer scheme. The token is read from Authorization: Bearer <token>, with the scheme matched case-insensitively. In config-file mode an Authorization header with another scheme, or the bare placeholder without Bearer, now answers 401 invalid_scheme. Check hand-written HTTP clients that send Authorization: OWE_…: they must send Authorization: Bearer OWE_…. SDKs for OpenAI and OpenRouter already do.
Every 401 carries WWW-Authenticate: Bearer.
SSRF: numeric IP spellings such as 2130706433, 0x7f000001, 127.1 or 0177.0.0.1 are refused before any DNS lookup (403 ssrf_blocked).
Configuration checked at startup: a target without an absolute http(s) base_url or without host, or an agent allowed a target that does not exist, stops the gateway with an error naming it.