I know I can use regular expression for each Service, but is there (or could
there be) a global regular expression which checks every header passing by?

I know pound is meant as a proxy and not for security, but it's already reading
those headers and having it as a first line of defence and running as an
unprivileged user I'm sure it will break a lot of hacking scripts that are
meant to be talking to my webserver.

Even if there's no such global variable....
What kind of expression would you suggest to have in the HeadRequire to keep
those cowboys out of my system?

I have for instance one domain which only host some scripts and in its log I
can see a lot of attempts to get all kind of other stuff going...