Make header forwarding configurable via proto config

mcp_router's createUpstreamHeaders() forwards every request header to the backend except a small hardcoded skip-list (:method, :path, :authority, host, content-type, accept, the session header). That includes authorization and anything else the client sends.

// mcp_router.cc:1983
// TODO(botengyao): Make header forwarding (authorization, etc.) configurable via proto config.
if (request_headers_) {
  copyRequestHeaders(*request_headers_, *headers);
  ...

Since mcp_router aggregates multiple backends behind one filter, this matters in practice: a deployment mixing a trusted internal backend with a third-party one has no way to stop the client's authorization header from reaching both.

Before writing a PR, three things worth clarifying:

1. Filter-level (McpRouter), or per-backend (McpBackend)? createUpstreamHeaders(const McpBackendConfig& backend, ...) already takes the backend as an argument, it just doesn't consult it for header policy yet. Per-backend seems like the natural fit given mixed-trust backends are the actual motivating case, but wanted to check.
2. Reuse config.common.mutation_rules.v3.HeaderMutation (already embedded by ext_authz, ext_proc, header_mutation, transform), or a narrower purpose-built message like api_key_auth's recent Forwarding?
3. Does the default behavior stay strictly additive (unset field = today's forward-everything-except-skip-list), or is the current default itself worth tightening as part of this?

Happy to put up a PR once these are settled.

Part of #39174.

cc @botengyao