Improve HTTP headers logic (#1584)

* Relax forbidden headers constraints
  - remove restriction on browser-related headers
- allow any glob pattern (no need to end with `/` or `*`, because glob
patterns already require users to explicitly declare prefix matches if
that's the intention)
* Replace `List<Pair<, ...>>`; use `Map<String, ...>` instead
* Use glob pattern strings as an API throughout, instead of `Pattern`
(e.g. in `HttpClientBuilder`)
* Add HTTP headers to message passing API
* Add HTTP headers to executor API (introduces `ExecutorSpiOptions4`)
* Add tests for Gradle, CLI, and pkl-executor invocations
* Improve documentation
* Add `isGlobPattern` API to class `String` for in-language validation
of http headers
* Behavior change: make sure explicitly configured `User-Agent` in
`HttpClientBuilder` can be shadowed by headers (allows users to set
`--http-header "**=User-Agent: My User Agent"` and for this to be the
only user agent).

CC @kyokuping

docs/modules/pkl-cli/partials/cli-common-options.adoc

@@ -158,6 +158,23 @@ This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
 
+.--http-header
+[%collapsible]
+====
+Default: (none) +
+Example: `**=User-Agent: My User Agent` +
+
+Additional headers to add to outbound HTTP requests.
+
+The syntax is `<glob pattern>=<header name>:<header value>`, and any whitespace after the leading colon is trimmed.
+
+The glob pattern is used to match against the URLs of outbound HTTP calls, and the value is the header name and value to add.
+In the case of multiple matches, every header is added.
+
+To describe a prefix match, the `\\**` wildcard should be added to the pattern.
+For example, `https?://example.com/**` matches against every request to host `example.com`.
+====
+
 .--trace-mode
 [%collapsible]
 ====