client: don't reuse a pick's authority override on a later attempt (#9277)

`csAttempt.newStream` writes the gRFC A81 authority override from the
pick result into `cs.callHdr`, which is allocated once per
`clientStream` and shared by every `attempt`. Nothing clears `Authority`
between attempts, so once an attempt is picked to an endpoint that
carries a hostname, a retry whose own pick supplies no override still
goes out with the earlier endpoint's authority. An xDS cluster using
`auto_host_rewrite` whose endpoints do not all set hostname hits this on
any retry, and `:authority` is what selects the virtual host and what
RBAC host matchers run against on the receiving side.

Copy the call header per attempt so the override, like
`PreviousAttempts`, stays with the attempt that produced it. The value
is derived from that attempt's pick result, so the attempt is the right
scope for it; leaving it on the stream lets one endpoint's rewrite
outlive the pick that asked for it.

RELEASE NOTES:
* client: Fix a bug where a retried RPC could be sent with the
`:authority` value belonging to the endpoint chosen by an earlier
attempt, when a load balancer supplies an authority override (e.g. xDS
`auto_host_rewrite`)