Rpc header secret leak fix

[fnando]

What

# BEFORE
$ STELLAR_RPC_HEADERS="Authorization Bearer secret" stellar network add foo
--rpc-url https://example.com --network-passphrase test
error: invalid value 'Authorization Bearer secret' for '--rpc-header <RPC_HEADERS>': invalid HTTP header: must be in the form 'key:value'

For more information, try '--help'.

# AFTER
$ STELLAR_RPC_HEADERS="Authorization Bearer secret" target/debug/stellar network add foo --rpc-url https://example.com --network-passphrase test
❌ error: invalid HTTP header: must be in the form 'key:value'

Why

Close https://github.com/stellar/stellar-cli-internal/issues/75

Known limitations

N/A

[Copilot]

Pull request overview

Fixes a secret-leak scenario where clap error messages could echo raw STELLAR_RPC_HEADERS / --rpc-header values by deferring header validation to application code and emitting a generic “invalid HTTP header” error instead.

Changes:

• Change config::network::Args to collect raw RPC headers as Vec<String> and parse/validate later in Args::get.
• Add an “always succeeds” clap value parser for Network::rpc_headers and introduce Network::validate_headers(); network add now calls it before writing config.
• Add tests intended to ensure malformed header errors don’t expose secret values.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
cmd/soroban-cli/src/config/network.rs	Defers RPC header parsing/validation to avoid clap echoing raw values; adds validation helpers and tests.
cmd/soroban-cli/src/commands/network/add.rs	Validates headers before persisting a network to config.