httr2 1.2.3

• Mocked and cached responses now include the originating request in resp$request, just like real responses (#841).
• New httr2_translate() translates an httr2 request into the equivalent curl command (#795).
• last_response_json() now works with content-types that end with +json, e.g. application/problem+json (@cgiachalis, #782).
• oauth_*() token refresh now forwards token_params from the original flow, so extra token-endpoint parameters (e.g. a scope required on the token exchange) are sent on refresh as well as on the initial token request (@simonpcouch).
• oauth_client() gains a metadata argument: pass the result of oauth_server_metadata() and the client carries all of the server's endpoints, so the OAuth flows pick them up automatically instead of threading them into each call (#846).
• oauth_flow_auth_code() now correctly uses the same redirect URI for both authorization and token requests when using the default localhost redirect URL (@pedrobtz, #829).
• New oauth_server_metadata() discovers an OAuth/OpenID Connect issuer's endpoints from its .well-known metadata document (#845).
• req_auth_aws_v4() now correctly signs URLs containing encoded slashes (%2F) in path segments, such as ARNs in AWS Bedrock API paths (@thisisnic, #842).
• req_body_form() now creates a valid empty request body when no parameters are provided (@arcresu, #836).
• req_body_form() and req_url_query() no longer error with "C stack usage is too close to the limit" when given very long string values (#805).
• req_cache() no longer errors when a request is first performed with path then later without it (#840).
• req_error() is now applied to responses retrieved from the cache, so a custom is_error callback is respected on cache hits (#806).
• req_oauth_bearer_jwt() now uses its claim as the basis for a separate client assertion when the client also authenticates with auth = "jwt_sig", so you no longer need to supply the claim twice. As a result, oauth_client(auth = "jwt_sig") no longer requires a claim in auth_params at creation time (#825).
• req_oauth_device() gains a pkce argument to enable Proof Key for Code Exchange, matching oauth_flow_device() (#834).
• req_throttle() can now enforce multiple rate limits at once: supply a vector to capacity (and fill_time_s) to create one token bucket per limit, and each request must satisfy all of them (#555).
• resp_link_url() and iterate_with_link_url() no longer error on Link headers that contain a trailing comma (#804).
• resp_stream_aws() now parses byte, short, and integer headers as signed integers, matching the AWS event-stream specification (previously they were incorrectly read as unsigned).
• resp_stream_lines() no longer treats a bare carriage return (CR) as a line ending; only LF and CRLF terminate lines, which is what every modern streaming source produces.
• resp_stream_lines() no longer warns when the stream ends without a final line terminator (which is routine when streaming), and its warn argument is (softly) deprecated.
• resp_stream_lines(), resp_stream_sse(), and resp_stream_aws() now decode whole chunks at a time and hold the results in a queue, instead of rescanning and recopying the buffer for every line or event. This makes memory use and run time scale linearly rather than quadratically with the response size, so large streams use dramatically less memory and run much faster (e.g. reading a 1 MB response of short lines is now around 200x faster and allocates around 180x less memory) (#704).