Support trusted headers for remote exec WebSockets

[copyberry]

Support trusted headers for remote exec WebSockets

What changed

• Add RemoteEnvironmentOptions and upsert_environment_with_options so embedding hosts can attach trusted HTTP headers to remote exec-server WebSocket handshakes.
• Preserve the headers across session reconnects while redacting them from debug output.
• Reject invalid, duplicate, and WebSocket-controlled headers, and require wss:// for non-loopback destinations.
• Connect header-bearing loopback WebSockets directly, with DNS results restricted to loopback addresses.

Testing

• Cover header validation and redaction, delivery on initial connections and reconnects, and loopback destination enforcement.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}