Scope credential headers in http.custom.headers to hosts

[rzo1]

Follow-up to #2089.

The PR for #2089 limits http.basicauth.* credentials to the hosts listed in http.basicauth.hosts. Credential headers configured through http.custom.headers (Authorization, Cookie, X-Api-Key, anything in http.credentials.headers) are still sent to every host; only a startup WARN was added.

Scoping them needs its own design, e.g. a per-host form of http.custom.headers, and is a separate breaking change. Today the only per-site alternative is protocol.set-header metadata, which is awkward for seed-based crawls.