[nkavian]

Summary

Align session credential handling with AEP specifications #58.

• Preserve API-key values as complete HTTP header values, including Bearer and Basic presentations, while rejecting unsafe header characters.
• Accept case-insensitive OAuth token types and empty Basic usernames, passwords, and realms.
• Allow configured API-key handlers to verify those presentations and reject ambiguous credential matches.
• Update documentation and regression tests for credential issuance, presentation, and revocation.

Validation

• ./mvnw verify
• ./scripts/verify-consumer.sh
• ./scripts/run-conformance.sh
• ./scripts/verify-gradle-consumer.sh
• ./mvnw --batch-mode --no-transfer-progress -pl aep-spring-webmvc -am -Pspring7 verify