fix: copy a set-cookie array passed to reply.header instead of storing it - #7068

reply.header('set-cookie', value) stores value in the reply's header map. When value is an array, the array object itself is stored, and every subsequent set-cookie call on the reply pushes into it (lib/reply.js, the Array.prototype.push.apply / .push branch). The string case already copies into a fresh array before pushing, so only the array case leaks the caller's object.

If the array is shared, for example a module-level default, it grows by one entry on every request, and responses carry more and more duplicate cookies:

const defaults = ['a=1']
fastify.get('/', (req, reply) => reply.header('set-cookie', defaults).header('set-cookie', 'b=2').send({}))
// 1st response: a=1, b=2   2nd: a=1, b=2, b=2   3rd: a=1, b=2, b=2, b=2 ...

reply.headers({ 'set-cookie': defaults }) goes through the same path.

This PR stores a copy of the array, so later pushes stay local to the reply.

Checklist

• run npm run test and npm run benchmark — test/internals/reply.test.js 86/86 with the change; the new test reply.header does not mutate a set-cookie array passed by the caller fails on main (the second response carries b=2 twice and the caller's array has grown) and passes with this change. eslint is clean.
• tests and/or benchmarks are included
• documentation is changed or added — n/a, behaviour now matches the documented one
• commit message follows commit guidelines