Extend headers policy by allowing templating

Use cases:

• Add a header to the request which contains signed value (a sensitive value that should not be tampered with, such as the username of the authenticated user or the name of the requesting application)
• Add a header to the response such as: quota consumption status, current API version, deprecation notice, JWT, etc.

Feature requests:

• Passing variables (e.g. JWT)
• Functions: e.g.  signing like: ${hmac_sha1 “secret-key”, $jwt.aud}

GH issue: https://github.com/3scale/apicast/issues/708