config: add PassIdentityHeaders option (#903)

Currently, user's identity headers are always inserted to downstream
request. For privacy reason, it would be better to not insert these
headers by default, and let user chose whether to include these headers
per=policy basis.

Fixes #702

internal/httputil/headers.go

@@ -66,3 +66,8 @@ var HeadersXForwarded = []string{
 	HeaderRealIP,
 	HeaderSentFrom,
 }
+
+// PomeriumJWTHeaderName returns the header name set by pomerium for given JWT claim field.
+func PomeriumJWTHeaderName(claim string) string {
+	return "x-pomerium-claim-" + claim
+}