CheckForbiddenCustomHeaders checks whether the custom header is allowed to be modified as per https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#custom-request-response-headers.

todo consider movinng this to solo-projects used in enterprise code.

HeaderSecretOptions is used to pass around information about whether/how to enforce that secrets and upstream namespace must match.