[ozamasa]

Summary

• include ActionController::DefaultHeaders in Devise::FailureApp
• apply config.action_dispatch.default_headers to failure responses
• verify that headers set explicitly by FailureApp still override defaults

FailureApp inherits directly from ActionController::Metal, so it does not receive the default-header behavior included by ActionController::Base and ActionController::API. Using Rails' ActionController::DefaultHeaders module keeps the response construction and header precedence consistent with Rails controllers.

Fixes #5201.

Testing

• Rails 8.1.3 / Ruby 3.4.1: test/failure_app_test.rb (46 runs, 92 assertions)
• Rails 8.1.3 / Ruby 3.4.1: full Active Record suite (880 runs, 2472 assertions)
• Rails 7.0.10 / Ruby 3.4.1: test/failure_app_test.rb (46 runs, 96 assertions)
• Rails 7.0.10 / Ruby 3.4.1: full Active Record suite (879 runs, 2412 assertions)