next.js

Add internal header security guideline to AGENTS.md

#92128

Merged