feat: add generic pipelock config merging for future extensibility

- Merge arbitrary pipelock settings from routes into global config
- Allows routes to configure new pipelock options without code changes
- Special-case tls_passthrough and ssrf_ip_allowlist (already aggregated)

Note: Pipelock doesn't currently support per-path/per-host response
scanning rules or response size limits, so response_body_scanning config
is not yet usable. For now, use tls_passthrough for binary download hosts.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

bot_bottle/pipelock.py

@@ -223,6 +223,15 @@ def pipelock_build_config(
     )
     if effective_ssrf_ip_allowlist:
         cfg["ssrf"] = {"ip_allowlist": effective_ssrf_ip_allowlist}
+
+    # Merge per-route pipelock config (e.g., response_body_scanning settings).
+    # Routes can specify arbitrary pipelock options that apply globally.
+    for route in bottle.egress.routes:
+        for key, value in route.Pipelock.Config.items():
+            if key not in ("tls_passthrough", "ssrf_ip_allowlist"):
+                if key not in cfg:
+                    cfg[key] = value
+
     return cfg