add support for cpl-token and update changelog

[jgrayson676]

Description of the change

Because the Authorization header is already in use, I opted to stick the token in a custom header

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Configuration change
• Technical Debt
• Documentation

Related tickets

https://app.shortcut.com/active-prospect/story/87918/send-cpl-data-to-trustedform

Checklists

Development and Testing

• Lint rules pass locally.
• The code changed/added as part of this pull request has been covered with tests, or this PR does not alter production code.
• All tests related to the changed code pass in development, or tests are not applicable.

Code Review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached.
• At least two engineers have been added as "Reviewers" on the pull request.
• Changes have been reviewed by at least two other engineers who did not write the code.
• This branch has been rebased off master to be current.

Tracking

• Issue from Shortcut/Jira has a link to this pull request.
• This PR has a link to the issue in Shortcut.

QA

• This branch has been deployed to staging and tested.

[cgrayson]

I think the value should probably be masked (like the TRUSTEDFORM_DATA_SERVICE_TOKEN in insights.js), right?

[jgrayson676]

I had thought that masking was updated to apply to all environment variables by default, but I'll double check that that's the case

[cgrayson]

👍