As part of the abstraction [1] of SecurityRequest/SecurityResponse, changes were made for how headers were processed. OpenSearch's RestRequest object treats headers as a Map<String, List<String>> whereas in the refactor this was simplified to Map<String, String> This has caused some plugins that extend behavior of the security plugin to be broken.

SecurityResponse classes should switch to a Map<String, List<String>> representation so workarounds aren't needed in downstream consumers.

• [1] Expanding Authentication with SecurityRequest Abstraction #3430

Acceptance Criteria

• Read up on duplicate header entries and how they are handled
  • Confirm if a refactor is needed or if this can be done via another method (comma delimited?) StackOverflow
• Update SecurityResponse from Map<String, String> headers; to Map<String, List<String>> headers;
• Fix all impacted areas of the codebase
• Add tests that use and verify duplicate header entries