how to use APM policy to grab user credentials from the http header and use them to login to external authentication database on behalf of the user

Have you checked out apm clientless mode?

https://support.f5.com/csp/article/K80934060#link_06_01

and you can make use of the irule here

https://clouddocs.f5.com/api/irules/ACCESS__user.html

" set apm_username [ string tolower [HTTP::username] ]

set apm_password [HTTP::password]"

And finally configure AD servers on the APM and if necessary use sso.

https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration-14-1-0/single-sign-on-methods.html