[PM-39812] fix: Apply SSO cookie request handlers to HTTPService download functions

[fedemkr]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39812

📔 Objective

The download(from:) and download(filename:) methods in HTTPService bypassed
the request handler pipeline entirely, meaning SSOCookieVendorRequestHandler never
injected load-balancer cookies into download requests. On servers configured with SSO
cookie vendor bootstrap, this caused attachment downloads to throw errors.

Fix: Both download methods now call applyRequestHandlers(to:) before passing the
request to the underlying client, mirroring what send(_:) already did. A failable
HTTPRequest.init?(from: URLRequest) bridges the URLRequest-based download API into
the HTTPRequest-based handler pipeline.

Note

The response handler was not added here as that handles HTTPResponse instead of URL on the download functions. We could potentially add handling for that as well but requires more complex changes. So for now the request handler has been added which adds the cookie if it's available as we think it's an edge case that just at the moment of downloading an attachment the cookie expires.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the fix that routes HTTPService.download(from:) and download(filename:) through the request handler pipeline so SSOCookieVendorRequestHandler can inject load-balancer cookies into download requests. The new HTTPRequest.init?(from:) bridge and the private applyRequestHandlers(to:) helper correctly convert to/from URLRequest, and the change is scoped to a path (apiUnauthenticatedService) that has no token provider, so no auth headers leak into external download URLs. Test coverage is thorough — covering the new initializer's default, populated, and nil-URL cases plus header injection for both download methods. Extracting the shared response handlers into Support/ files is a clean, behavior-preserving refactor.

Code Review Details

No findings. The change is well-scoped, correct, and well-tested.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 40.60%. Comparing base (993ce04) to head (714c92c).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
Networking/Sources/Networking/HTTPService.swift	0.00%	13 Missing ⚠️
Networking/Sources/Networking/HTTPRequest.swift	0.00%	8 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #2848       +/-   ##
===========================================
- Coverage   81.15%   40.60%   -40.55%     
===========================================
  Files        1027      356      -671     
  Lines       65896    16644    -49252     
===========================================
- Hits        53475     6758    -46717     
+ Misses      12421     9886     -2535     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[matt-livefront]

These changes look good, looks like there's one test failure though.