docs(security): document custom app token headers

[AkashKumar7902]

Thank you for helping make the Dapr documentation better!

Please follow this checklist before submitting:

• Commits are signed with Developer Certificate of Origin (DCO - learn more)
• Read the contribution guide
• Commands include options for Linux, MacOS, and Windows within tabpane
• New file and folder names are globally unique
• Page references use shortcodes instead of markdown or URL links
• Images use HTML style and have alternative text
• Places where multiple code/command options are given have tabpane

In addition, please fill out the following to help reviewers understand this pull request:

Description

Documents the custom app API token header support for HTTP and gRPC callbacks. This covers the DAPR_APP_API_TOKEN_HEADER environment variable, the dapr.io/app-token-header Kubernetes annotation, replacement and default behavior, and the case where a custom name is configured without APP_API_TOKEN.

The companion runtime PR will be linked here after it is created.

Validation: npm run build:production completed successfully with Hugo v0.147.8.

Issue reference

Related to dapr/dapr#7147.

[AkashKumar7902]

Superseded by #5256, which uses the requested personal AkashKumar7902 fork.