REST option extra _headers callback

[varnerac]

Would you consider a PR for an "extra headers" callback on the REST module? In addition to CORS (#947), there are security-related headers and maybe application-specific headers that could benefit from an option callback. It'd just take a tuple list of headers.

I would also use it to implement a headers option on cowboy_static�.

[essen]

Where would it be located in the graphs?