feat(proxy): support OAuth providers with integration-level secret headers

[LevSky22]

Problem

Nango cannot currently model an OAuth provider that also requires a separate integration-level secret on every proxied API request.

OAuth client credentials are stored on the integration and access/refresh tokens are stored on each connection. Providers can also declare additional integration_config fields, but static Proxy headers cannot interpolate those custom integration values. In the dashboard, declaring integration_config also replaces the normal OAuth credential form instead of augmenting it.

BeeTexting is the motivating provider: each API Connect application issues a Client ID, Client Secret, and distinct API key. API calls require both the OAuth bearer token and X-API-Key.

Proposed platform support

1. Allow declared integration configuration fields in static provider Proxy headers:

   proxy:
       headers:
           x-api-key: ${integrationConfig.apiKey}
   integration_config:
       apiKey:
           type: string
           title: API Key
           secret: true

2. Resolve the value from the integration's encrypted custom configuration while preserving the existing OAuth bearer-token behavior.

3. Fail closed when a referenced field is undeclared or has no configured value.

4. Redact secret integration values from Proxy logs.

5. Prevent a Proxy caller from overriding a provider-owned header backed by a secret integration field.

6. Show OAuth Client ID, Client Secret, and scope controls alongside additional integration_config fields in integration create/settings forms.

Explicit empty provider body

Some API gateways reject bodyless write requests when the HTTP client selects a form-encoded content type. The motivating provider accepts an empty JSON object. The proposed behavior treats an explicitly declared empty proxy.body: {} as meaningful and produces {} for a bodyless write while preserving caller-provided JSON, form, binary, or multipart data.

This is distinct from omitting proxy.body, which retains the existing null behavior.

Security properties

• Only fields declared by the provider's integration_config schema can be referenced.
• Fields marked secret are added to Proxy log redaction values.
• Missing required values stop the request instead of silently omitting authentication.
• Caller header casing cannot be used to replace a protected provider header.

Validation

• Provider schema validation passes with the motivating configuration.
• The behavior is running successfully on a self-hosted Nango deployment.
• Unit coverage has been added for interpolation, missing/undeclared values, caller override protection, redaction, and explicit empty-body handling.

Related provider issue: #6882.

[linear-code]

NAN-6416