[Feature]: Allow preserving multiple values in Alpha Config injectRequestHeaders

Motivation

This is a narrower follow-up to #2455: allow an individual Alpha Config injectRequestHeaders entry to opt out of header value flattening, while preserving the current default behavior.

Kubernetes impersonation is a concrete use case. Multiple groups are represented using repeated Impersonate-Group headers:

Impersonate-Group: group-a
Impersonate-Group: group-b

With a multi-valued groups claim:

injectRequestHeaders:
  - name: Impersonate-Group
    values:
      - claimSource:
          claim: groups

oauth2-proxy currently flattens those values to:

Impersonate-Group: group-a,group-b

Kubernetes treats that as a single group rather than two. We confirmed this directly with kubectl auth can-i: two separate --as-group values authorize the request in our setup, while a single --as-group='group-a,group-b' does not. See kubernetes/kubernetes#82468.

The comma-combined representation cannot always be safely split back into the original values because group names may themselves contain commas. For example, these two group sets are distinct:

["group-a", "group-b"]
["group-a,group-b"]

but flattening makes them indistinguishable.

Regarding the HTTP semantics raised in #2455, RFC 9110 §5.3 discusses combining repeated field lines in terms of preserving their semantics. For this use case, flattening can lose information.

Possible solution

Allow individual Alpha Config injectRequestHeaders entries to preserve multiple values, for example:

injectRequestHeaders:
  - name: Impersonate-Group
    preserveMultipleValues: true
    values:
      - claimSource:
          claim: groups

Without the option, the current flattening behavior would remain unchanged.

Provider

None