FetchApi is not used, so backstage authorization header is not passed to proxy endpoint

This means unless you are hosting behind an authenticating proxy, the backstage `/api/proxy/circleci` endpoint can be used by anyone who can access the endpoint.

This also means that anyone hosting backstage, and blocking access to api endpoints without an `Authorization` header, cannot use this plugin.

Locate the Backstage /api/proxy/circleci endpoint and inspect how FetchApi is or is not used. Verify that requests require and forward the backstage Authorization header, including for hosts that block API endpoints without one; the issue names no files or tests to run.

Written by the indexing model from the issue text.