[Neha Bhargava (neha-bhargava)]

Targets 4.13.2. Builds on the regression fix from #3943 (already merged).

What

Adds explicit request-customization hooks to DownstreamApi, consuming the new AuthorizationHeaderProviderOptions members from Microsoft.Identity.Abstractions 12.5.0 (AzureAD/microsoft-identity-abstractions-for-dotnet#262):

• OnBeforeAuthHeaderCreation — runs before the header is created/signed. Use it to shape the request that a request-binding protocol signs (SignedHttpRequest q/h/b), so the signature covers the finalized request.
• OnAfterAuthHeaderCreation — runs after the header is attached. The pre-existing CustomizeHttpRequestMessage is still invoked at the same point for backwards compatibility (both run; distinct hooks).

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also

BaseAuthorizationHeaderProvider and DefaultAuthorizationHeaderProvider declare IAuthorizationHeaderProvider2 only (it already extends IAuthorizationHeaderProvider), and the Base provider's delegate field is typed IAuthorizationHeaderProvider2 to avoid upcasting.

Tests

• Flow test shapes the flowed request via OnBeforeAuthHeaderCreation (asserting it reaches the provider before signing).
• Lifecycle test: OnBefore sees no header (runs before); OnAfter and CustomizeHttpRequestMessage both observe it.
• with SHR / without SHR tests asserting the Authorization header is created and attached in both cases.
• Full suite: 1036 passed / 4 skipped / 0 failed.

Depends on

AzureAD/microsoft-identity-abstractions-for-dotnet#262 (Abstractions 12.5.0) — the Abstractions package floor bump is pending its release.

The base branch was changed.