New WPT requirement: API key should be in the headers

Hi team!

Client X received feedback from Catchpoint that the API key should now be part of the `X-WPT-API-KEY` header of a request rather than as a parameter in the query,

Opening this issue and will follow-up with a PR shortly!

Cheers!

Xavier

Full details from support:

> There have been recent changes to our API key requirement, which may impact the way you interact with our services. Effective immediately, we have made updates to the way API keys are requested and utilized.
>
> Previously, we allowed API keys to be included as a query parameter (k=) in API requests. However, to enhance security and streamline our processes, we have made the decision to enforce the inclusion of the API key exclusively in the header of the request.
>
> As a result, the use of the k= parameter in API requests will no longer be accepted. Instead, API keys must now be included in the X-WPT-API-KEY header of the request.
>
> Here is an example of how to structure your API request with the updated requirements:
>
> curl -X GET -i GET '[https://www.webpagetest.org/runtest.php?url=www.example.com"](https://urldefense.com/v3/__https:/www.webpagetest.org/runtest.php?url=www.example.com*22__;JQ!!Lt0KOR8!Rag93Gl4qcXGcvzu62O_8I40MQwdFzJ_vxhcLkGv_cXllwvYtSJSCPJvTqNdclvKJWmM5wJ99RwjY3VOYDU8htZsDRGoWQSN$) -H "Accept: application/json, text/plain, */*" -H "X-WPT-API-KEY: your-api-key-here" -H "Content-Type: application/json"