Support allowed_client_headers_on_success in External Auth

[tokongs]

Please describe the problem you have
[A clear, concise, description of the problem you are facing. What is the problem that feature X would solve for you?]

The problem I'm trying to solve is that I need to be able to refresh a cookie on successful auth.

As far as I can tell the headers I set in my auth service are not propagated to the client. Envoy supports this feature using allowed_client_headers_on_success on extensions.filters.http.ext_authz.v3.AuthorizationResponse. It would be great if Contour could expose that option.

[github-actions]

Hey @tokongs! Thanks for opening your first issue. We appreciate your contribution and welcome you to our community! We are glad to have you here and to have your input on Contour. You can also join us on our mailing list and in our channel in the Kubernetes Slack Workspace