chore(iast): header source in werkzeug 3.1

[avara1986]

IAST taint source Header wouldn't work correctly in werkzeug>=3.1.0

We're tainting EnvironHeaders.__getitem__ due to get method calls to __getitem__
https://github.com/pallets/werkzeug/blob/2.3.8/src/werkzeug/datastructures/headers.py
but now the __getitem__ and get methods of EnvironHeaders are completely differents:
https://github.com/pallets/werkzeug/blob/main/src/werkzeug/datastructures/headers.py

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/appsec/_iast/_handlers.py                                       @DataDog/asm-python
hatch.toml                                                              @DataDog/python-guild
tests/appsec/integrations/flask_tests/test_iast_flask.py                @DataDog/asm-python

[datadog-dd-trace-py-rkomorn]

Datadog Report

Branch report: avara1986/APPSEC-56329-werkzeug_header_source
Commit report: 0ffc9b1
Test service: dd-trace-py

✅ 0 Failed, 130 Passed, 1184 Skipped, 3m 49.52s Total duration (24m 51.05s time saved)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-02-05 08:35:27

Comparing candidate commit 0ffc9b1 in PR branch avara1986/APPSEC-56329-werkzeug_header_source with baseline commit a54a55d in branch 3.x-staging.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 394 metrics, 2 unstable metrics.