Add environment variable support to header_injection auth

[jhrozek]

Adds header_value_env field to header_injection authentication strategy, enabling secrets to be resolved from environment variables at config load time instead of hardcoded in YAML files.

Changes:

• Add header_value_env field to rawHeaderInjectionAuth struct
• Implement validation: exactly one of header_value or header_value_env required
• Update token_exchange and service_account to use env.Reader consistently
• Add 6 comprehensive test cases covering all edge cases
• Update documentation and examples to show both usage patterns

This follows the same pattern as token_exchange (client_secret_env) and service_account (credentials_env) strategies. Environment variables are resolved at config load time with fail-fast validation.

Backward compatible: existing header_value (literal) configurations continue to work unchanged.

Example usage:
outgoing_auth:
backends:
github:
type: header_injection
header_injection:
header_name: "Authorization"
header_value_env: "GITHUB_API_TOKEN"

Fixes: #2573

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.06%. Comparing base (6472796) to head (6272867).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2574      +/-   ##
==========================================
+ Coverage   55.00%   55.06%   +0.05%     
==========================================
  Files         306      306              
  Lines       28978    28989      +11     
==========================================
+ Hits        15940    15962      +22     
+ Misses      11629    11611      -18     
- Partials     1409     1416       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.