Bug 2073282 - Add deprecated api_key=<key> query-parameter fallback to native Mojo REST auth

[Xzzz]

Summary

Adds a fallback to Bugzilla::App::Plugin::Login's Mojo login check so ?api_key=<key> query parameters are accepted the same way the legacy WebService dispatcher already accepts them, in case undiscovered callers rely on it (like k8s monitoring service actually do).

Please note that this is a deprecation-pending stopgap, not a first-class supported method (docs already warn this method is likely to be deprecated due to security concerns).

Changes

• Bugzilla::App::Plugin::Login's bugzilla.login helper: fall back to the api_key query/body parameter when the X-Bugzilla-API-Key header is absent, same precedence and validation path (revoked/sticky-IP checks, rate limiting) as the header case
• qa/t/rest_native_login.t: cover authentication via ?api_key=
• docs/en/rst/api/core/v1/general.rst: note that native Mojo REST resources also accept the deprecated api_key query parameter as a fallback

Test plan

• GET a native Mojo REST endpoint with ?api_key=<valid key> and no header -> authenticates
• Existing qa/t/rest_native_login.t cases (header, cookie + token) unaffected

References

• Bugzilla link: 2073282

[dklawren]

Thanks for jumping on this quickly.

[dklawren]

LGTM. r=dkl