feat: Allow fixed request headers in server conformance tests

[jirispilka]

Problem

Server conformance tests accept the target only through --url. Servers that require a fixed bearer token must put it in the query string, which exposes the credential in the runner's process arguments and in output that prints the target URL.

For example:

conformance server --url 'http://127.0.0.1:3001/?token=SECRET'

Environment variables keep the token out of the parent shell command, but the runner still receives the expanded URL as an argument.

Requested capability

Allow callers to add fixed HTTP request headers to server conformance traffic without placing their values in the URL. An interface such as repeatable --header 'Authorization: Bearer ...' arguments or a header file/environment option would solve this.

Requirements:

• Apply the headers to every request sent to the server under test.
• Do not print header values in normal or verbose output.
• Keep secrets out of child-process arguments when an environment or file-based form is used.
• Document precedence if authorization scenarios need to override a configured header.

This was found while running MCP 2026-07-28 and 2025-11-25 server conformance tests against an authenticated endpoint in apify/apify-mcp-server#1173.