Drafted with Claude, reviewed manually.

WebhookRawBodyMiddleware (#1668) makes the raw POST body reachable
inside DAG runs as WEBHOOK_PAYLOAD, but request headers are dropped
before the DAG sees the run.

Forwarding an allow-listed subset (e.g. via a per-DAG or base.yaml
forward_headers field) would unblock common webhook patterns:

• event routing on X-GitHub-Event / X-Gitea-Event
• idempotency on X-GitHub-Delivery, Stripe-Idempotency-Key
• in-DAG signature verification (native HMAC covered separately in Native HMAC-SHA256 verification on webhook deliveries #2036)

Sketch on top of #1668:

1. webhook_middleware.go — capture allow-listed headers into ctx
2. webhooks.go::TriggerWebhook — append WEBHOOK_HEADERS=<json> to params
3. api/v1/api.yaml — document the new param

Authorization should never be forwardable.

Discussion context:
https://discord.com/channels/1095289480774172772/1409891877288939560/1497580577325453373

Happy to put up a PR.