Active attacks can inject into header names
### Purpose
Injection locations should be created for header names in a request.
### Example
A request with the following head:
```
GET /page/1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
Host: www.gitlab.com
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
```
Five injection locations should be created, one for `User-Agent`, `Host`, `Accept-Language`, `Accept-Encoding`, and `Connection`. The injection location should replace the name of the header, not the value.
issue