Make middleware thread-safe

[titanous]

Rack middleware must not use instance variables for state, as the same instance can be called by multiple threads. This patch changes the middleware to pass all request state as method arguments.

As a result of the lack of thread safety in the current version, it is possible for the middleware to handle a request incorrectly, using the @request instance variable from another request. This can present itself as random redirects to other URLs for a small subset of requests, when using a threaded Rack server like Puma.

I have reproduced and verified this issue using a test application with many requests in a specific pattern that we observed in production to trigger this issue. After this patch, the issue no longer occurs.

[jubishop]

it'd be nice if this could get merged.

[dentarg]

I've published my own version of rack-ssl-enforcer to RubyGems.org under the name spinels-rack-ssl-enforcer with this patch applied. The repo is at https://github.com/spinels/rack-ssl-enforcer.