[padams]

Adds OWA 2.x application passwords as a REST credential, for the WordPress plugin's 2.x mode.

Changes

• credentials['app_password'] sends Authorization: Bearer <password>.
  • No X-API-KEY and no X-SIGNATURE, so no auth_key is needed.
  • When both kinds are set, the application password wins.
• Lookup order matches the keys: the credentials config, then OWA_APP_PASSWORD (environment variable or constant), then app_password = in ~/.owa/credentials.
• getCredentials() now returns app_password beside api_key / auth_key. The two tests that asserted the old two-key array are updated to the new shape.
• Not sent over http://. An application password with an http:// instance_url fails before any request, with Application password not sent: instance_url is not https. allow_insecure_app_password (default false) sends it anyway, for an install with app_passwords_require_https off. The key pair is unaffected.
• The failure log carries no token (test added); logFailure() writes only the method, the URL without its query, and the reason.
• README section on application passwords; sdk::VERSION 1.2.0.

Tests

• 8 new tests: Bearer without signing; not sent over http; sent over http with allow_insecure_app_password; key pair still sent over http; app password wins over the key pair; from the environment; from the credentials file; not in the failure log.
• Without the https check, the not-sent-over-http test fails.
• Against the 1.1.1 client, 8 of the 9 credential tests fail. The log test passes there because 1.1.1 never sends a token.
• Locally: 81 tests pass, phpstan reports no errors, lint passes.

The server side is OWA v2's Auth::appPasswordCredential(). Bearer is one of the two forms it accepts, and over plain HTTP it refuses unless app_passwords_require_https is off.