Add `--forward-headers` to pass selected client headers through to the upstream API

[ImFlog]

Hello, I started a POC using this project and had an issue.

Problem

When an MCP client calls a tool, the upstream HTTP request is built from scratch in
executeToolCall (pkg/server/server.go:536), which receives only
(*ToolCallParams, *mcp.ToolSet, *config.Config) never the inbound *http.Request.
The inbound request is read solely for X-Connection-ID / sessionId
(server.go:303). So headers set by the client are silently dropped, and tools/list
succeeds while every tools/call against an authenticated API fails.

Today the only ways to authenticate upstream are server-side and static:
--api-key* (server.go:652) and REQUEST_HEADERS (server.go:731). Both mean one
credential shared by every caller, which rules out per-user auth. The remaining option is to
declare Authorization as a header parameter in the spec and turns the credential into a
tool argument, so it passes through the model's context and conversation history.
Which I am not comfortable with.

Proposal

A repeatable/comma-separated allowlist flag:

--forward-headers Authorization,X-Request-Id

Thread http.Header from httpMethodPostHandler (server.go:301, where r is already
in scope) through handleToolCallJSONRPC (server.go:770) into executeToolCall, and
apply the filtered set in the existing header block (server.go:722-742).

Three properties that matter:

1. **Allowlist only, never blanket => To avoid leaking unwanted data.
2. Forwarded headers lose to server-side config. So a client cannot replace the server's own credential.
3. Redact in logs. (already leaks today but could be worth fixing in the same time.

Happy to open a PR if you want.

On a side note, there is no licensing on this project. As it's for my company It is mandatory to know this before any usage.