feat(supabase): add opt-in header inclusion in realtime WebSocket params

[mandarini]

Summary

Adds opt-in support for including global.headers in Realtime WebSocket query params, enabling RLS policies that check request.headers to work with realtime subscriptions.

Usage:

  createClient(url, key, {
    global: { headers: { 'x-tenant-id': 'tenant-123' } },
    realtime: { includeHeadersInParams: ['x-tenant-id'] }
  })

Changes

• New realtime.includeHeadersInParams option in createClient()
• Specified headers are copied to WebSocket URL as query params
• Fully backward compatible (opt-in only)

Use Case

Enables multi-tenant patterns where tenant context is passed via headers (e.g., x-tenant-id) to work with realtime subscriptions, addressing issue #1797.

[coveralls]

coverage: 95.636% (-0.2%) from 95.853%
when pulling 19bd833 on fix/realtime-headers-ws
into e8a644e on master.

[mandarini]

Closing after discussing internally with the team. Tagging @filipecabaco