Add provider default_headers for fresh auth on destroy (Closes #83) - #162

Summary

• Add optional provider default_headers map (sensitive) applied to every outbound HTTP request
• Provider headers override resource/state headers on matching keys, so fresh auth tokens replace stale values during destroy
• Fixes terracurl Destroy Operation Uses Stale ID Token from State File #83 where expired GCP ID tokens in state caused 401 errors on destroy

Test plan

• Unit tests for header merge precedence, Host override, and Delete with stale state + fresh provider meta
• go test ./... passes locally
• CI green before merge

Migration

Move short-lived auth headers from resource headers / destroy_headers to provider default_headers:

provider "terracurl" {
  default_headers = {
    "X-Serverless-Authorization" = "Bearer ${data.google_service_account_id_token.sa_gcp.id_token}"
  }
}

See docs/guides/default_headers.md for details.

Made with Cursor