Capture request headers

[jessarcher]

This PR introduces the capturing of request headers on inbound requests.

The following headers will be redacted by default:

• Cookie - cookie names will be captured, but cookie values will be redacted.
• Authorization and Proxy-Authorization - the authorization type (e.g. Basic, Bearer) will be captured, but the remainder of the value will be redacted.
• X-XSRF-TOKEN - the full value will be redacted.

The redacted headers can be customized with the NIGHTWATCH_REDACT_HEADERS environment variable. E.g:

NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-XSRF-TOKEN,Secret-Header

The value specified here will override the defaults, so be sure to keep the default values if you wish for them to be redacted.

When a header is redacted, the header name is always preserved so you know what headers were present. The value will be replaced by an indication of how many bytes were redacted. E.g. [123 bytes redacted].