add additional x-middleware-set-cookie filtering (#75561)
Previously when we removed this from the response we only did so for
requests that flowed through middleware and static handlers. We should
ensure it's filtered in `sendResponse` as well. The header is only
needed internally.
