Improve HTTP headers logic (#1584)

* Relax forbidden headers constraints
  - remove restriction on browser-related headers
- allow any glob pattern (no need to end with `/` or `*`, because glob
patterns already require users to explicitly declare prefix matches if
that's the intention)
* Replace `List<Pair<, ...>>`; use `Map<String, ...>` instead
* Use glob pattern strings as an API throughout, instead of `Pattern`
(e.g. in `HttpClientBuilder`)
* Add HTTP headers to message passing API
* Add HTTP headers to executor API (introduces `ExecutorSpiOptions4`)
* Add tests for Gradle, CLI, and pkl-executor invocations
* Improve documentation
* Add `isGlobPattern` API to class `String` for in-language validation
of http headers
* Behavior change: make sure explicitly configured `User-Agent` in
`HttpClientBuilder` can be shadowed by headers (allows users to set
`--http-header "**=User-Agent: My User Agent"` and for this to be the
only user agent).

CC @kyokuping

docs/modules/bindings-specification/pages/message-passing-api.adoc

@@ -210,6 +210,11 @@ class Http {
   ///
   /// Each rewrite must start with `http://` or `https://`, and must end with `/`.
   rewrites: Mapping<String, String>?
+
+  /// HTTP headers.
+  /// Each entry key is a glob pattern that is matched against outbound request URLs.
+  /// Each value is a map of headers that is added to the matching request.
+  headers: Mapping<String, Mapping<String, Listing<String>>>?
 }
 
 /// Settings that control how Pkl talks to HTTP proxies.