The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP header" will be sent as one or several elementary
write() calls, which will then be emitted as some IP packets; the position of the split, and the exact timing between the emissions, may tell quite a lot on the involved software.
The ordering of HTTP headers may also give clues about the server software. I see that you use
gzip compression: zlib will be involved, but not all versions compress the same input to the exact same sequence of bytes (decompression is fully deterministic, but compression leaves open a lot of choices, and each version of zlib can make distinct choices when it strives to achieve the maximum compression rate or the fastest operation).
The only surefire way to hide your software version is to write your own software (and never publish it). Writing your own operating system or at least TCP/IP stack, though feasible, is a quite daunting endeavour.
Anyway, I will argue that preventing version detection is not really relevant. If an attacker knows one or two unpublished attacks, then... he will just try them out. Just in case. He does not need to know the exact version of the software for that. Knowing the exact version is useful only when the attacker has hundreds or thousands of exploits to choose from, and does not have enough time to try them all; this situation does not apply to unreported exploits, which tend to be valuable because they are rare. A given attacker would consider himself very lucky indeed if he has access to more than two or three exploits which are, as yet, unknown to the public at large.