In a http request/response, mac address would be meta data. ARP is not a thing there. That would be an example of data snaffling.
I tried some quick packet sniffing browsing Google and did not see my MAC transmitted—as I’d expect (bc like you said, ARP not thing at this layer) also research on “MAC included in http metadata” turns up no results…
If you have any more info on this I’d love to learn more—as I’m puzzled to know why this would happen?