Lowercase header issue: SecureHeaders::OPT_OUT Fails to Remove Non-Lowercase Headers in Rails Default Config

[GabDesilets]

Bug

Gem version: 7.1.0
Rails: 6.1
Ruby: 3.3.6

Following this change from this pull-request
It introduce a regression and an unwanted behavior with some headers.

While using SecureHeaders::OPT_OUT as a value to override the X-Frame-Options header we're not deleting the header.

It happens because here in railtie.rb
we are only looking for the lowercase key values.
The default written X-Frame-Options never get match because keys are case sensitive.

This is a potential bigger issue since looking a recent version of rails action_dispatch here it is still using the non lowercase keys.

Expected outcome

1. The header is removed from the headers list in the response when using SecureHeaders::OPT_OUT.

Actual outcome

1. Any Non downcase header with the SecureHeaders::OPT_OUT value doesn't get remove.

Suggestions:

default_headers = Rails.application.config.action_dispatch.default_headers
unless default_headers.nil?
 default_headers.each_key do |header|
 if conflicting_headers.include?(header.downcase)
 default_headers.delete(header)
 end
 end
end