Conformance suite: pdp_auth_type=api_key is unusable with discovery, and blocks the invalid-credentials 401 module

Two of the pdp_auth_type=api_key paths in the AuthZEN conformance modules do not work. Both are in the conformance suite rather than the specification; filing here since #640 is also a harness report.

api_key cannot be combined with pdp_server_metadata=discovery.

AddApiKeyAuthenticationParametersToAuthzenApiRequest reads the key from the pdp environment object:

String secret = env.getString("pdp", "api_key");

but GetPDPDynamicServerConfiguration replaces that object wholesale with the fetched metadata document:

JsonObject serverConfig = JsonParser.parseString(jsonString).getAsJsonObject();
env.putObject("pdp", serverConfig);

so the pdp.api_key supplied in the test configuration is gone by the time the first authenticated request is built. GetPDPStaticServerConfiguration puts config.pdp into the environment instead, which keeps it. Every (discovery, api_key) run therefore fails at the first authenticated condition with:

'PDP API Key' field is missing from the 'AuthZEN' section in the test configuration

Observed on all 148 applicable modules across the six AuthZEN plans. The same two variant parameters are advertised as independent, so the combination is selectable in the UI.

authzen-pdp-evaluation-invalid-credentials-returns-401 cannot run under api_key.

The module declares itself applicable to it:

@VariantNotApplicable(parameter = PDPAuthType.class, values = {"none", "mtls"})

but CorruptAuthzenClientCredentials requires a client object:

@PreEnvironment(required = {"client", "pdp"})

and @VariantSetup(parameter = PDPAuthType.class, value = "api_key") never creates one, so the module ends with:

couldn't find required object in environment before evaluation: client

The condition body already handles either credential, corrupting client.client_secret and pdp.api_key independently and erroring only when neither is present, so requiring client up front looks stricter than intended.

Found running the six AuthZEN plans against an OPA-based PDP. With static + api_key the rest of the suite is unaffected: 145 of 149 modules pass, the remainder being this one and #640.

Start by locating AddApiKeyAuthenticationParametersToAuthzenApiRequest, GetPDPDynamicServerConfiguration, GetPDPStaticServerConfiguration, and CorruptAuthzenClientCredentials in the conformance suite. Run the six AuthZEN plans with discovery plus api_key and the invalid-credentials module under api_key. Done means the discovery combination preserves the configured key and the invalid-credentials module reaches its 401 evaluation without requiring an unused client object.