Ok, will answer myself: the only way I found to do this is the local mode (already mentioned) - intended for development - the trick is to use a git clone to get the go-workspace, ie not to use the release archive. Also note that the plugins tag is replaced by localPlugins.
Static conf:
experimental:
localPlugins:
headerdump:
moduleName: "github.com/jaybubs/headerdump"`
Dynamic conf:
middlewares:
my-headerdump:
plugin:
headerdump:
Prefix: HDlog
TLS: "true"
Then add the my-headerdump middleware to the router with a label.
The directory struct in the traefik container needs to be:
/plugins-local/src/github.com/<plugin owner>/<output of git clone github.com/<plugin owner>/<plugin name>
/plugins-local/src/github.com/jaybubs/headerdump/...