pub fn resolve_headers(
templates: &[(String, String)],
) -> Result<Vec<(String, String)>, String>Expand description
Resolve every {{secret:NAME}} / {{secret-file:PATH}} ref in each header
VALUE against the process environment + filesystem, returning materialized
(name, value) headers ready for the wire. Header names pass through as-is.
An unresolved ref is an Err that names the ref but never any resolved
value: diagnostics travel to logs and operators, so a credential must never
ride along in one.