feat(openid-connect): map verified claims to upstream request headers

[shreemaan-abhishek]

Description

Upstream services that do not parse tokens need selected claims as plain request headers. openid-connect can only forward whole tokens (X-Access-Token, X-ID-Token, X-Userinfo). The common workaround is a serverless-pre-function that decodes the token a second time, depends on plugin priority, and has to clear spoofed headers itself.

This PR adds upstream_headers, a list of {header, path} mappings. path is an array of keys, one per nesting level, so claim names containing ://, / or . work as is.

"upstream_headers": [
  { "header": "X-Profile-Id", "path": ["https://example.com/claims/profile/id"] },
  { "header": "X-Org-Id", "path": ["org", "id"] }
]

• Claim source: only claims the plugin already verified.
  • bearer_only / public_key / use_jwks / introspection: the verified token payload or the introspection response.
  • Authorization code flow: the ID token first, then userinfo for claims the ID token lacks.
• Spoofing: every declared header is reset after authentication on every outcome (success, deny, unauth_action: pass, multi-auth fallthrough). It holds the verified claim or nothing.
• Serialization:
  • strings as is
  • numbers and booleans as text (integers printed in full)
  • arrays of scalars joined by a space (an array scope becomes read write)
  • other arrays and objects as JSON
  • missing, null or empty values set no header
• Routes without upstream_headers run no extra code.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[membphis]

LGTM