Any way to use payload data in headers / cookies?

This was indeed a challenge, and maybe the following isn't exactly what you're looking for, but here goes:

when RULE_INIT {
     User-defined: New URI value for replacement
    set static::GOODURI "GOODURI"
     User-defined: Old URI pattern to match (starts_with?)
    set static::URIPATTERN "uri"
}
when HTTP_RESPONSE {
    STREAM::disable
    if { [HTTP::header Content-Type] contains "text" } {
        HTTP::collect [HTTP::header Content-Length]
    }
}
when HTTP_RESPONSE_DATA {
     Find the HREF elements
    set indices [regexp -all -inline -indices -nocase {
                 Full URL
                catch {
                    if { [scan $url {<%*s %*[^:]://%*[^/]/%[^/]} URI] } {
                         If scanned URI value matches the predefined pattern...
                        if { [string tolower $URI] starts_with $static::URIPATTERN } {
                             Create a new URL with the replaced value
                            set new_url [string map "$URI $static::GOODURI" $url]
                             Append the found/matched URI to the URILIST list
                            lappend URILIST $URI
                             Append the old and new URLs to the STREAMLIST list
                            lappend STREAMLIST $url
                            lappend STREAMLIST $new_url
                        }
                    }
                }
            } else {
                 Relative URL
                catch {
                    if { [scan $url {<%*s %*[^/]/%[^/]} URI] } {
                         If scanned URI value matches the predefined pattern...
                        if { [string tolower $URI] starts_with $static::URIPATTERN } {
                             Create a new URL with the replaced value
                            set new_url [string map "$URI $static::GOODURI" $url]
                             Append the found/matched URI to the URILIST list
                            lappend URILIST $URI
                             Append the old and new URLs to the STREAMLIST list
                            lappend STREAMLIST $url
                            lappend STREAMLIST $new_url
                        }
                    }
                }
            }
        }
        
         If STREAMLIST is not empty (matched href values), generate a STREAM expression and replace the payload
        if { $STREAMLIST ne "" } {
             Create a STREAM expression from the STREAMLIST list
            set STREAMTEXT ""
            for { set i 0 } { $i < [llength $STREAMLIST] } { incr i } {
                if { [expr { $i %2 }] == 0 } {
                     first string (old)
                    append STREAMTEXT "@[lindex $STREAMLIST $i]"
                } else {
                     second string (new)
                    append STREAMTEXT "@[lindex $STREAMLIST $i]@"
                }
            }
             Evaluate the STREAM expression to replace all of the payload content
            STREAM::expression "$STREAMTEXT"
            STREAM::enable
        }
        
         We created a list of found/matched URIs. This can be used to send headers/cookies to the client
        for { set x 0 } { $x < [llength $URILIST] } { incr x } {
            HTTP::cookie insert name ORG_URL_${x} value [lindex $URILIST $x]
        }
    }    
}

Here's how it works:

1. Issue a collect statement in the HTTP_RESPONSE event

2. In the HTTP_RESPONSE_DATA event perform a regexp command that builds a list of lists - a list of the start and end indexes for every "a href=..." string in the payload.

3. If the list isn't empty, start a loop

4. Use catch and scan commands to extract the first part of the URI from the anchor string (full and relative URLs).

5. Once found, create a new URL by string mapping the predefined GOODURI over the matched old URI.

6. Add the new and old URLs to a list (STREAMLIST).

7. After the loop, if the STREAMLIST list isn't empty, create a STREAM expression from the list (@old url@new url@ @old url@new url@ @old url@new url@...) and evaluate the expression to replace all of the old content in the payload.

8. During the loop, another list was created to store the matched URIs. After the STREAM expression, loop through this list to produce the values you need for cookies. This will create a different cookie for each matched URI (if more than one).

A header won't be returned to the server, so a cookie is probably the better route. Not having enough information to know exactly how the application works, I had to assume that 1) there might be more than one offending URI in the payload, 2) you have a specific pattern that you're looking for, and 3) you'll need to devise a method to remap the incoming URI back to the original, which would be a bit more complicated if there was more than one replacement. It might actually make more sense to send the entire old URI in the cookie values, or perhaps even better to encode the original URI as a query string object at the end of each replaced URI.

Example: a href="./GOODURI/blah/F5_URL=unnf89sdfnds98dsn32..."