[SHB-20993]: php-webfleet - migrate to http basic auth

[Iandenh]

Webfleet deprecated username/password in the request URL; the
URL-based authentication is removed end of June 2026.

Credentials are now base64-encoded into an Authorization: Basic
header per RFC 7617 and unconditionally stripped from the query
string. account, apikey and sessiontoken remain query parameters.

Also drops a redundant normalizeHeaders() call in TinyCurlClient
that doubled the Authorization prefix (vendor Request::fetch
normalizes once, the adapter was normalizing again).

Bumps the PHP requirement to 7.1 for a nullable return type.

[Copilot]

Pull request overview

This PR updates php-webfleet to comply with Webfleet’s upcoming deprecation of URL-based username/password authentication by moving credentials to an RFC 7617 HTTP Basic Authorization header and stripping credentials from the query string. It also removes a redundant header normalization step that could corrupt the Authorization header, and bumps the minimum PHP version to support a nullable return type.

Changes:

• Add WebfleetOptions::getBasicAuthHeader() to generate an RFC 7617 Basic auth header value.
• Strip username/password from request query params and send credentials via Authorization: Basic ... header.
• Stop double-normalizing headers in TinyCurlClient and bump minimum PHP to 7.1 (README + composer).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/WebfleetOptions.php	Adds helper to build a Basic auth header from configured credentials.
src/WebfleetEndpoint.php	Removes URL credentials from query parameters and injects an Authorization header into requests.
src/HTTP/TinyCurlClient.php	Avoids double header normalization that could break header formatting.
README.md	Updates documented PHP requirement to 7.1+.
composer.json	Updates PHP requirement to >=7.1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.