Implement Email Header Allow-List Validation for Workflow Configuration

User Story

As a workflow administrator, I want to be able to select only from a predefined list of allowed email headers when configuring email workflows, so that I can ensure our email communications maintain security standards while still having the flexibility to choose which headers are appropriate for each workflow.

Acceptance Criteria

• [ ] Create a configurable allow-list of email headers that are permitted in our email workflows. The default headers allowed are: reply-to and return-path
• [ ] Display the default allowed headers in the input field/text area when a user configures an email workflow
• [ ] Allow users to remove headers from the predefined list but prevent them from adding custom headers not in the allow-list
• [ ] Implement client-side validation (if possible) to show an error when a user attempts to add a header not in the allow-list
• [ ] Implement server-side validation as a security measure to ensure only allowed headers are processed
• [ ] Add appropriate error messaging when validation fails
• [ ] Document the feature for administrators who will configure the allow-list
• [ ] Include unit and integration tests covering the validation functionality

Proposed Objective

Core Features

Proposed Priority

Priority 2 - Important

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

https://dotcms.slack.com/archives/CQNF9PCFQ/p1744305166599389

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

The issue names no files, entry points, or tests; start by locating the email workflow configuration and existing email-header handling in the Java codebase. Done means configurable defaults for reply-to and return-path, client- and server-side rejection of unapproved headers, suitable error messaging, administrator documentation, and unit and integration coverage.