feat(ui-server): add forward of static headers from env

[wensiet]

Description & motivation 💭

This PR introduces static headers forwarding to gRPC temporal frontend.

Our scenario is:

• custom authorizer & claim-mapper plugin for temporal server
• TLS is provided by the infrastructure and cannot be configured
• to authenticate request, we need custom header, like x-service-auth=some-token-here
• it works with temporal-cli or SDK's, with grpc-meta, but UI only has forwarding headers, which is not suitable

To solve this issue, we introduce new env var: TEMPORAL_SERVER_STATIC_HEADERS. It is later converted to config field staticHeaders.

Format is: TEMPORAL_SERVER_STATIC_HEADERS="some-header=someval,another-header=someval"

Screenshots (if applicable) 📸

No ui components changed.

Design Considerations 🎨

No ui components changed.

Testing 🧪

Manually tested with temporal-frontend. Added unit tests to ensure logic is correct.

How was this tested 👻

• Manual testing
• E2E tests added
• Unit tests added

Steps for others to test: 🚶🏽‍♂️🚶🏽‍♀️

Add staticHeaders to configs, example:

staticHeaders:
  authorization: some-tkn

Or use ENV var TEMPORAL_SERVER_STATIC_HEADERS="authorization=some-tkn"

Checklists

Draft Checklist

Merge Checklist

Issue(s) closed

Docs

Any docs updates needed?

Yes, UI startup docs.

[vercel]

Someone is attempting to deploy a commit to the Temporal Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

All committers have signed the CLA.

[wensiet]

@laurakwhit hi! can you take a look at it pls

[laurakwhit]

it works with temporal-cli or SDK's, with grpc-meta, but UI only has forwarding headers, which is not suitable

@wensiet can you provide a little more context as to why forwarding headers is not suitable for your use case?

[wensiet]

Someone is attempting to deploy a commit to the Temporal Team on Vercel.

A member of the Team first needs to authorize it.

If we use forwarding we will need to expose token to ui end user (for example tech support) and somehow forward it (for example via browser extensions). However we already have authorization in UI via SSO, so it creates some amount of redundant actions, and does not allow us to seamlessly rotate token.