fix: restore req/res prototypes when a mounted app hands control back

[lazerg]

app.handle swaps the req/res prototypes for its own, but only app.use() puts them back, inside the mounted_app closure it wraps around a sub-app. Mount an app with router.use() instead and the swap is never undone, so every middleware that runs after the sub-app calls next() reads req.app, req.ip, req.secure and req.hostname through the sub-app's settings rather than the parent's.

app.handle now saves the prototypes it replaces and restores them before invoking the callback it was handed, so the cleanup happens on whichever path the app was mounted through. The issue suggested patching restore() inside router, but the swap originates here, and doing it here also covers any other caller that passes a callback without needing a router release.

This covers the prototype half of #7427 only. A router-mounted app still gets no mount event and so does not inherit trust proxy, which would need router to know about express apps.

Fixes #7427