XRPC client: support ratelimit bypass header

[bnewbold]

The typescript PDS instance (and appview, presumably?) is getting new application-level ratelimits. There is an HTTP header that can be used to bypass it. In several contexts, at least fakermaker, we'll want to bypass these limits using the special header. To do this, we should add support in the XRPC client to config a new optional auth secret (rate limit bypass), and include it on every HTTP request. And then wire up the config.