how can I define the ingress without hardcoding the auth-header in the ingress definition?

Develop own controller. An example how to do it is here.

If you don't want to attach it to Ingress entity - somebody has to.

Own controller can watch existing ingresses (filtered by some your label) and update Ingress Manifests: attach annotations you want.

The introspect endpoint (decodes JWT token and attaches it to original request that is proxied to other microservices) is not exposed outside of the cluster but I want the extra peace of mind knowing that the endpoint, even in the cluster, only responds to authenticated requests (auth-header is a base64 encoded string which contains a client secret and client id)

If you want to hide your JWT token to Secret - there is no easy way to do it with vanilla Nginx IngressController. The source says, that:

nginx.ingress.kubernetes.io/auth-snippet: <Auth_Snippet> to specify a custom snippet to use with external authentication, e.g.

i.e. just a sample of nginx config you may include, without additional transformations.

But if you can deploy additional IngressController instance, you can use global-auth-snippet parameter there.

Add your snippet to Nginx's ConfigMap. Then create some IngressClass and add kubernetes.io/ingress.class=my_ingress_class_name annotation to your Ingresses (or even make the class Default for cluster)