Add excluded_response_headers config for redacting response headers

[craigpotter]

Overview of change

First of three follow-ups from the review pass behind #17 (split for clean history: feature / schema / accuracy fixes).

Response headers were stored completely unredacted — including Set-Cookie, so session cookies could land in the barstools table. This adds excluded_response_headers, mirroring the request-side exclusions:

'excluded_response_headers' => [
    'Set-Cookie',              // default
    // '*',                    // redact every response header
    // SensitiveConnector::class,
    // SensitiveRequest::class,
],

• Named headers are matched case-insensitively (consistent with the request-side fix in Fix five recording correctness bugs #17) and stored as REDACTED
• '*' or a connector/request class redacts every response header value (keys kept, values REDACTED)
• Set-Cookie is redacted by default — a behaviour change for existing installs, but a safe direction (data that was previously leaking into logs is now masked)

README updated with a matching section.

Testing

Two new tests: default Set-Cookie redaction alongside untouched headers, and a dataset covering '*'/connector-class/request-class wildcard redaction. Full suite: 42 passed (172 assertions), PHPStan level 8 clean, Pint clean.