feat(elasticsearch-logger): encrypt headers field at rest

[shreemaan-abhishek]

Description

The elasticsearch-logger plugin recently gained a custom headers field (#12994) that can carry secret-bearing values such as Authorization or X-API-Key. Until now only auth.password was listed in encrypt_fields, so those header secrets were stored in plaintext in etcd.

This PR adds headers to encrypt_fields so every header value is encrypted with AES at rest, while runtime requests still send the decrypted values. encrypt_fields already supports map-of-strings fields, so each value under headers is encrypted/decrypted individually.

Docs (en + zh) and a data-encryption test for headers are included.

Which issue(s) this PR fixes:

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible

[Copilot]

Pull request overview

This PR ensures secrets placed in the elasticsearch-logger plugin’s headers configuration are encrypted at rest in etcd by adding headers to the plugin schema’s encrypt_fields. It also updates the English/Chinese plugin documentation and adds a regression test to confirm headers are decrypted via Admin API responses while remaining encrypted in etcd storage.

Changes:

• Add headers to encrypt_fields in the elasticsearch-logger plugin schema so each header value is encrypted/decrypted via the generic data-encryption mechanism.
• Add a test that verifies headers.Authorization is plaintext when read through the Admin API and ciphertext when read directly from etcd.
• Update en/zh docs to state headers values are encrypted at rest and to reflect the updated encrypt_fields list.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
apisix/plugins/elasticsearch-logger.lua	Adds headers to encrypt_fields so header values are encrypted at rest in etcd.
t/plugin/elasticsearch-logger.t	Adds a data-encryption test case verifying decrypt-on-read via Admin API and encrypted storage in etcd for headers.
docs/en/latest/plugins/elasticsearch-logger.md	Documents that headers values are encrypted at rest and updates the encrypt_fields note accordingly.
docs/zh/latest/plugins/elasticsearch-logger.md	Same documentation update as English version for headers encryption and encrypt_fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.