Optionally include/exclude grpc headers by name

[jbf154]

Sometimes headers can contain sensitive information (for example, the Authorization header). This update enables the user to optionally specify a list of headers to:

• specifically exclude or
• specifically include

[yurishkuro]

What relationship does tracing interceptor have with authorization headers?

[jbf154]

If you use any header (like the Authorization header) to transmit sensitive data and have opentracing configured to tag the HTTP headers in the span, that tag will have the contents of the sensitive header. Right now you can disable the HEADERS attribute, but that disables tagging all headers. Sometimes it is useful to tag some headers and omit others, hence this change.

In our use case, we are using OAuth bearer tokens passed into our services using the Authorization header. The tokens are sensitive and ideally would not be included in the spans generated.