Headers other than "Authorization" are not provided to pystac

[vprivat-ads]

I try validation of my STAC API using custom API key authentication introduced in 0.6.3 (#392), passed through an header named x-api-key.

The header is used to retrieve the landing page, but is not used by pystac when validating the browseable conformance class:

Traceback (most recent call last):
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/stac_api_validator/validations.py", line 593, in validate_api
          validate_browseable(landing_page_body, errors, warnings, r_session)
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/stac_api_validator/validations.py", line 858, in validate_browseable
          for item in take(10, catalog.get_all_items()):
                               ^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/catalog.py", line 617, in get_all_items
          return chain(
                 ^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/catalog.py", line 619, in <genexpr>
          *(child.get_items(recursive=True) for child in self.get_children()),
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_object.py", line 428, in get_stac_objects
          link.resolve_stac_object(root=self.get_root())
                                        ^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_object.py", line 326, in get_root
          root_link.resolve_stac_object()
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/link.py", line 330, in resolve_stac_object
          obj = stac_io.read_stac_object(target_href, root=root)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_io.py", line 234, in read_stac_object
          d = self.read_json(source, *args, **kwargs)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_io.py", line 205, in read_json
          txt = self.read_text(source, *args, **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_io.py", line 282, in read_text
          return self.read_text_from_href(href)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/home/vprivat/projects/env/lib/python3.12/site-packages/pystac/stac_io.py", line 303, in read_text_from_href
          raise Exception(f"Could not read uri {href}") from e

      Exception: Could not read uri https://<my-server>/catalog/
      
      Captured logging:
      DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): <my-server>:443
      DEBUG:urllib3.connectionpool:https://<my-server>:443 "GET /catalog/ HTTP/1.1" 200 969
      INFO:stac_api_validator.validations:Validating STAC API - Core conformance class.
      DEBUG:urllib3.connectionpool:https://<my-server>:443 "GET /catalog/api HTTP/1.1" 200 60490
      DEBUG:charset_normalizer:Encoding detection: ascii is most likely the one.
      DEBUG:urllib3.connectionpool:https://<my-server>:443 "GET /catalog/api.html HTTP/1.1" 200 None
      DEBUG:pystac.stac_io:GET https://<my-server>/catalog/ Headers: {}
      INFO:stac_api_validator.validations:Validating STAC API - Browseable conformance class.
      DEBUG:pystac.stac_io:GET https://<my-server>/catalog/ Headers: {}

I guess this block should be changed to remove the hardcoded "Authorization" header name (or at least allowing us to configure it):

    if r_session.headers and r_session.headers.get("Authorization"):
        stac_io.headers = r_session.headers  # noqa, type: ignore