Support for arbitrary headers in per_path_config in keybase pages

It would be great to be able to set arbitrary response headers in per-path, just as it is done with Access-Control-Allow-Origin for CORS.

The use case I'm thinking of, specifically, is to be able to set Cache-Control: public, no-transform to disallow html modification by intermediates such as Cloudflare (which adds a js beacon to track page views and the like)

However, this could open up other use cases such as Content-Security-Policy and whatnot.

I imagine this can be achieved with .kbp_config:

{
	"version": "v1",
	"per_path_configs": {
		"/": {
			"anonymous_permissions": "read",
			"Content-Security-Policy": "default-src: 'none'",
			"Cache-Control": "public, no-transform",
			"Access-Control-Allow-Origin": "*"
		},
	}
}

As a side effect, this could allow setting values other than "*" for CORS headers.

Start by locating the Keybase Pages handling for .kbp_config and per_path_configs, using the existing Access-Control-Allow-Origin behavior as the entry point. Verify how arbitrary header names and values would be validated and applied, then confirm that Cache-Control, Content-Security-Policy, and existing CORS responses are emitted for the configured path.