feat: Implement header-based collection and geometry filtering

[bountx]

Related Issue(s):

• Endpoint collections-search/{collection-id} does not work #516

Description:
Adds support for filtering search results based on HTTP headers. This enables granular access control at the proxy layer while keeping sfeos authorization-agnostic.

Headers:
X-Filter-Collections: Comma-separated collection IDs to restrict access
X-Filter-Geometry: GeoJSON geometry for spatial filtering (requires optional dependency shapely)

Affected endpoints:

Endpoint	Collection Filter	Geometry Filter
GET /collections	Yes	Doesn't apply
GET /collections/{id}	Yes (404 if denied)	Doesn't apply
GET /collections/{id}/items	Yes (404 if denied)	Yes (via search)
GET /collections/{id}/items/{id}	Yes (404 if denied)	Yes (404 if denied)
GET/POST /search	Yes	Yes

Important:
There are no overhead computations if headers are not present for backwards compatibility.

PR Checklist:

• Code is formatted and linted (run pre-commit run --all-files)
• Tests pass (run make test)
• Documentation has been updated to reflect changes, if applicable
• Changes are added to the changelog