Add Heroku Button headers to the whitelist

Add `heroku-deploy-source` and `heroku-deploy-source` headers to the whitelist, so they get sent to API, so we could list where the deploys are actually coming from. 

See https://github.com/heroku/dashboard-v6/pull/400.