Filter internal Rack headers in CGI responses

[OskarEichler]

Rack's response contract reserves rack.* names for internal metadata and requires servers not to send them to clients. Rackup's WEBrick handler already filters these names, but the CGI handler currently emits them verbatim.

Skip rack.* entries while serializing CGI response headers, matching the existing server-handler behavior.

Verification:

• deterministic CGI model fails on 2.3.1/current and passes this branch
• full suite: 76 runs / 194 assertions / 0 failures
• Ruby syntax, warning-mode load, package build and diff checks pass on Ruby 4.0.6
• combined candidate also passes 74 runs / 182 assertions on Ruby 3.2.11

No breaking API change for valid response headers.