Support configurable PDP auth header

[omribz156]

Summary:

• Add PDP_AUTH_HEADER so PDP API calls can authenticate with a configurable bearer-token header while defaulting to Authorization.
• Reuse the configured header for enforcer auth, facts forwarding, and cloud proxy forwarding, while still sending the token upstream as standard Authorization.
• Add focused coverage for the custom-header path.

Fixes #296.

Verification:

• uv run --with-requirements requirements.txt --with-requirements requirements-dev.txt --with-editable . ruff check horizon\authentication.py horizon\config.py horizon\enforcer\api.py horizon\facts\client.py horizon\facts\router.py horizon\proxy\api.py horizon\tests\test_authentication.py
• uv run --with-requirements requirements.txt --with-requirements requirements-dev.txt --with-editable . pytest horizon\tests\test_local_api.py horizon\tests\test_authentication.py -q
• uv run --with-requirements requirements.txt --with-requirements requirements-dev.txt --with-editable . pytest horizon\tests\test_enforcer_api.py -q

This was implemented with Codex assistance, with the final patch reviewed and kept focused on the auth-header path.