Enable custom server response headers through opensearch.yml configuration

The objective of this feature is to provide a configuration open in opensearch.yml to enable the server to send custom HTTP response headers.

The option can be defined as shown below:
http.custom.headers: ["Strict-Security-Transport:max-age=31536000; includeSubDomains;"]

Running this "curl -v -u admin:admin http://localhost:9200" command would return the below bold header in the HTTP response. (The below response is coming from Elasticsearch but the same is expected with OpenSearch)

• Rebuilt URL to: http://localhost:9200/
• Trying ::1...
• TCP_NODELAY set
• Connected to localhost (::1) port 9200 (#0)
• Server auth using Basic with user 'admin'

GET / HTTP/1.1
Host: localhost:9200
Authorization: Basic YWRtaW46YWRtaW4=
User-Agent: curl/7.55.1
Accept: /

< HTTP/1.1 200 OK
< Strict-Security-Transport: max-age=31536000; includeSubDomains;
< content-type: application/json; charset=UTF-8
< content-length: 506
<
{
"name" : "LAPTOP-C0J5I3L2",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "xVUOVOAGR4iaNHA2AEv1pw",
"version" : {
"number" : "7.8.0",
"build_flavor" : "oss",
"build_type" : "zip",
"build_hash" : "unknown",
"build_date" : "2021-02-16T10:30:42.633581400Z",
"build_snapshot" : false,
"lucene_version" : "8.5.1",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}

Start by locating how OpenSearch reads opensearch.yml and how its HTTP server assembles responses; the issue does not name implementation files or tests. Use the provided curl command to verify that headers configured through http.custom.headers are returned in server responses, including the example Strict-Security-Transport header.