docs: document authorization header forwarding from transformer to predictor

## Summary

KServe v0.20 added automatic forwarding of authorization headers (`Authorization`, `X-Request-ID`, `X-B3-TraceID`) from transformer to predictor, enabling transformer-predictor chains to work with auth-enabled predictors. No documentation exists for this feature.

## What needs to be documented

- The `_FORWARDABLE_HEADER` allowlist and `_filter_headers` helper behavior
- Which headers are forwarded: `Authorization`, `X-Request-ID`, `X-B3-TraceID`
- How this works in HTTP and gRPC predict/explain paths
- Requirements for custom transformer implementations to leverage header forwarding
- Update custom transformer documentation to mention this behavior

## Related PR

- https://github.com/kserve/kserve/pull/5567

## Since

KServe v0.20

Start with the custom transformer documentation and the implementation details for _FORWARDABLE_HEADER and _filter_headers. Document the three forwarded headers, their HTTP and gRPC predict/explain behavior, and the requirements for custom transformers. Done means the custom transformer documentation covers this KServe v0.20 behavior clearly.

Written by the indexing model from the issue text.