feat(ai-anthropic, ai-openai): support custom HTTP headers for custom model endpoints

[safisa]

What it does

Adds an optional headers map to custom model entries for ai-anthropic and ai-openai, sent with every request to that endpoint.

Fixes #17906

Custom model entries can only configure url and apiKey today. Deployments that route LLM traffic through a gateway in front of the vendor API commonly require additional headers for audit, attribution or routing, and reject requests that omit them — the only workaround being a reverse proxy that injects them.

"ai-features.anthropicCustom.customAnthropicModels": [{
    "model": "...",
    "url": "https://llm-gateway.internal/v1",
    "apiKey": "...",
    "headers": { "X-Audit-User-Type": "service", "X-Audit-User-Name": "theia" }
}]

The map is passed to the SDK clients as defaultHeaders, so it also covers the Anthropic /v1/models lookup that resolves model metadata — a gateway enforcing the headers rejects that request too, which otherwise degrades the model's capabilities silently.

Values are resolved through a shared resolveCustomModelHeaders helper in ai-core: preferences are user-authored JSON, so entries with a non-string value are dropped, and undefined is returned when nothing usable remains, leaving the default request headers untouched.

How to test

1. Configure a custom Anthropic or OpenAI model whose url points at a local endpoint that logs the headers it receives, and add a headers entry.
2. Send a chat message — the configured headers are on the request; without a headers entry the request is unchanged.
3. Edit a header value in settings while the app is running — the next request carries the new value, no reload needed.
4. npx mocha packages/ai-core/lib/common/language-model.spec.js covers resolveCustomModelHeaders.

Verified against a local HTTP server standing in for a gateway: the headers are present on /v1/messages and /v1/chat/completions for both providers through the full request() path, and absent when not configured.

Follow-ups

Only static per-model values are in scope here. Per-request or per-user header values (e.g. attributing a request to the signed-in user) would need request-scoped plumbing through the language model request pipeline, and are left out deliberately.

Breaking changes

• This PR introduces breaking changes and requires careful review. If yes, the breaking changes section in the changelog has been updated.

The new headers field and the widened constructors are optional, so existing adopters are unaffected.

Attribution

Contributed on behalf of K2view

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

• As a reviewer, I agree to behave in accordance with the review guidelines