Fix/apikey placement npe

[jlouvel]

Related Issue

Closes #212

---

What does this PR do?

When an apikey authentication spec omits the placement field, HttpClientAdapter.setChallengeResponse() threw a NullPointerException on placement.equals("header").

This PR adds a null guard that throws a clear IllegalArgumentException with the message "placement is required for apikey authentication (expected: header or query)".

---

Tests

Added setChallengeResponseShouldThrowWhenApiKeyPlacementIsMissing in HttpClientAdapterTest — verifies the exception type and message when placement is omitted.

---

Checklist

• CI is green (build, tests, schema validation, security scans)
• Rebased on latest main
• Small and focused — one concern per PR
• Commit messages follow Conventional Commits

---

Agent Context (optional)

agent_name: GitHub Copilot
llm: claude-opus-4-5
tool: VS Code Chat
confidence: high
source_event: "#212"
discovery_method: user_report
review_focus: HttpClientAdapter.java:136-140

[eskenazit]

It seems this branch has way too much files for just a fix, it looks like this branch was rebased from chore/mcp-restlet-transport and not main, or that chore/mcp-restlet-transport was merged into it. This makes the PR hard to review, since we need to explore the commit list to find what is related to the fix, and what it noise from other branches. Plus this generates conflicts ^^'

Let us discuss branch management and rules to avoid that in the future =)

[jlouvel]

@eskenazit There was no need to initially create this PR based on the mcp-auth one. I've rebased on main to it only has the 2 useful commits in

[eskenazit]

LGTM