Move HTTP headers out of the input Rego variable

The HTTP headers of the evaluation request are placed inside the Rego global input variable. This leads to unintended side-effects when using the input variable as arbitrary JSON input to policy evaluations.

The headers must be moved outside of the input variable.

They should be placed in a separate global variable headers.