• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

This adds cookies and header parameters to Utils::Curl.curl_args and related options to the livecheck url DSL method, to allow setting these values in livecheck blocks. Like the recently-added user_agent and referer options, these are intended to align with options that the Cask url method allows (using the same name and types). [I think these are the only other options from the cask url method that I wanted to add but I figured it would be good to take care of them before the next brew release.]

We only have six casks using cookies (none using header) but I was looking through old brew issues and saw that we had a need for setting cookies and header values in livecheck blocks in the past (#11675), so I figured it wouldn't be a bad idea to offer these as well. We don't have any casks using header but yaak@beta uses an alternative livecheck block approach because the preferred approach requires setting a request header, so this will allow us to implement that check.

One thing to note about the implementation is that a cookies argument to curl_args will replace the --cookie /dev/null argument. From what I've seen, using --cookie /dev/null doesn't seem to print cookies to stdout, unlike the --cookie-jar /dev/null approach that it replaced. Using --cookie with a cookies argument seems to act the same way (i.e., enabling the cookie jar but not actually printing cookies to stdout), so that may be okay. That said, I may not fully understand this behavior and the goals of the existing --cookie code, so do let me know if this isn't an appropriate way to handle this.

I tested this by running brew audit --strict --online on the casks that use cookies and didn't see any issues. To be clear, CurlDownloadStrategy has its own cookie-handling logic that's used for downloading the file but the curl_args logic seems to be exercised when running other audits on the cask url (i.e., if you remove all of the --cookie code from curl_args, an audit will visibly fail when testing a related cask like crushftp). Besides that, I also manually tested the options in livecheck blocks to make sure that the curl arguments worked as expected.