Immutable-friendly HTTP and safer middleware

Request::withAttribute() and Response::with* make middleware safer and easier to reason about. Plus a note on PHP 8.5's clone-chain pitfall.