feat(otel): support OTEL_EXPORTER_OTLP_HEADERS for authenticated export

[prashar32]

Authenticated OTLP export

The OTel exporter could only talk to an unauthenticated endpoint — there was no way to send an auth token. So any backend that requires one couldn't receive spans, and the example's Honeycomb row (x-honeycomb-team header "via std OTEL env") was actually a broken promise.

This reads the standard OTEL_EXPORTER_OTLP_HEADERS (and the traces-specific OTEL_EXPORTER_OTLP_TRACES_HEADERS, which wins if both are set) — a comma-separated list of key=value pairs — and attaches them to every span export over both gRPC and HTTP:

export OTEL_EXPORTER_OTLP_ENDPOINT=https://api.honeycomb.io
export OTEL_EXPORTER_OTLP_HEADERS="x-honeycomb-team=$HONEYCOMB_API_KEY"
# or any Bearer endpoint:
export OTEL_EXPORTER_OTLP_HEADERS="authorization=Bearer $TOKEN"

Header values carry secrets, so they're never logged (the startup line logs only endpoint + protocol).

Verified

• Parse: whitespace trimming, values containing =, malformed pairs skipped, TRACES_HEADERS precedence over HEADERS.
• On the wire: a test stands up an OTLP/HTTP receiver, exports a span through the real exporter, and asserts the Authorization header arrives. go test ./... green.

Unblocks authenticated backends like Honeycomb and Grafana Cloud.