Support gzipped responses in check session URLs

[aeneasr]

Describe the bug

See #835

[dreverri]

If a request manually sets the Accept-Encoding header the transport will not automatically decode the response.

https://pkg.go.dev/net/http#Transport.DisableCompression

Currently, it looks like oathkeeper copies all the headers from the original request so if the original request has the Accept-Encoding header the body will not decompressed.

oathkeeper/pipeline/authn/authenticator_cookie_session.go

Line 152 in 9375f92

for k, v := range r.Header {

[aeneasr]

Ah, I see, that makes sense!

[till]

@aeneasr PR coming soon. We somehow hit that.