[PM-39812] fix: Apply SSO cookie request handlers to HTTPService download functions

[fedemkr]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39812

📔 Objective

The download(from:) and download(filename:) methods in HTTPService bypassed
the request handler pipeline entirely, meaning SSOCookieVendorRequestHandler never
injected load-balancer cookies into download requests. On servers configured with SSO
cookie vendor bootstrap, this caused attachment downloads to throw errors.

Fix: Both download methods now call applyRequestHandlers(to:) before passing the
request to the underlying client, mirroring what send(_:) already did. A failable
HTTPRequest.init?(from: URLRequest) bridges the URLRequest-based download API into
the HTTPRequest-based handler pipeline.

Note

The response handler was not added here as that handles HTTPResponse instead of URL on the download functions. We could potentially add handling for that as well but requires more complex changes. So for now the request handler has been added which adds the cookie if it's available as we think it's an edge case that just at the moment of downloading an attachment the cookie expires.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the fix routing HTTPService.download(from:) and download(filename:) through the request handler pipeline so SSOCookieVendorRequestHandler injects load-balancer cookies into download requests. The new HTTPRequest.init?(from:) bridge, the applyRequestHandlers(to:) helper, and the header round-trip were verified for correctness. Confirmed both production call sites (apiUnauthenticatedService, fillAssistService) are token-provider-free, so no unintended Authorization header is injected. Test refactor extracting shared response handlers into Support files and updated coverage are appropriate.

Code Review Details

No findings. The header round-trip is safe (handlers only add to headers seeded from the original request), the nil URL guard is covered by tests, and the omission of response handlers is intentional and documented in the PR description.

[codecov]

Codecov Report

❌ Patch coverage is 95.23810% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 79.00%. Comparing base (dae7094) to head (d3fddbd).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
Networking/Sources/Networking/HTTPService.swift	92.30%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2848      +/-   ##
==========================================
- Coverage   81.25%   79.00%   -2.26%     
==========================================
  Files        1028     1151     +123     
  Lines       66164    73508    +7344     
==========================================
+ Hits        53761    58073    +4312     
- Misses      12403    15435    +3032     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[matt-livefront]

These changes look good, looks like there's one test failure though.