Configurable headers in external extractor / reducer requests

[rogerhutchings]

For the work that I've been doing for 1715 Labs recently, it turns out it'd be helpful to be able to configure header fields when using the external extractor; in this case, because I'd like to secure the API endpoint it's hitting (at least with basic auth).

[camallen]

This would be super useful and a great way to ensure our external services, e.g aggregation-caesar.zooniverse.org is protected from spam