feat: Allow fixed request headers in server conformance tests

Problem

Server conformance tests accept the target only through --url. Servers that require a fixed bearer token must put it in the query string, which exposes the credential in the runner's process arguments and in output that prints the target URL.

For example:

conformance server --url 'http://127.0.0.1:3001/?token=SECRET'

Environment variables keep the token out of the parent shell command, but the runner still receives the expanded URL as an argument.

Requested capability

Allow callers to add fixed HTTP request headers to server conformance traffic without placing their values in the URL. An interface such as repeatable --header 'Authorization: Bearer ...' arguments or a header file/environment option would solve this.

Requirements:

• Apply the headers to every request sent to the server under test.
• Do not print header values in normal or verbose output.
• Keep secrets out of child-process arguments when an environment or file-based form is used.
• Document precedence if authorization scenarios need to override a configured header.

This was found while running MCP 2026-07-28 and 2025-11-25 server conformance tests against an authenticated endpoint in apify/apify-mcp-server#1173.

Start by locating the server conformance command's --url parsing and the code that constructs requests and prints targets. Trace authorization scenarios and determine how configured headers interact with them. Done means headers reach every server request, values stay out of normal and verbose output, environment or file forms avoid child-process arguments, and precedence is documented.