Support providing `secret` as header, not just a param, to avoid logging.

As per discussion here https://discord.com/channels/933657521581858818/933657523049885698/1408202901331120268 it seems helpful and sensible to support providing the secret as a header as well a query parameter.

Note that the HTTP spec currently requires as a param (unless running in insecure mode) https://electric-sql.com/openapi.html#/paths/~1v1~1shape/get

Notes:
- if we do this, I'm not sure if it's relevant to add the secret header to the vary header?