Add request Headers to OPA authorization request

[massenz]

We currently only send the path and method to OPA for authorization (alongside the JWT); we should also send "relevant" (as defined by the user) headers.

This could be a mix of "well-known" as well as "custom" headers:

opa:
  headers:
    - x-org-id
    - x-user-def
    - ContentType

If any (or all) of the headers are missing in the API call, they are simply ignored and the authorization is sent to OPA: auth policies will decide if those are required and access ought to be denied if missing.

The headers will be sent in the OPA request as key-value pairs (we assume single-valued headers):

      {
        "input": {
            "api_token": ".... API Token Base-64 encoded ...",
            "resource": {
                "method": "POST",
                "path": "/path/to/resource",
                "headers": [
                  { "name": "x-org-id", "value": "123456"},
                  { "name": "ContentType", "value": "application/json"},
                  ...
                ]
           }
        }
      }

and will be available as an array of objects in the Rego policy at input.resource.headers, and each header will be accessible as, for example input.resource.headers["x-org-id"].

[massenz]

Completed in #45