Issue Description:

Summary

When the package manager sets an authorization header on a url request, and is using the URLSessionHTTPClient as underlying http client, it's misusing URLSession/URLRequest since the "Authorization" header is a reserved one on macOS:
See https://developer.apple.com/documentation/foundation/urlrequest
and linked https://developer.apple.com/documentation/foundation/nsurlrequest#1776617
> Reserved HTTP Headers
> The URL Loading System handles various aspects of the HTTP protocol for you (HTTP 1.1
> persistent connections, proxies, authentication, and so on). As part of this support, the URL > Loading System takes responsibility for certain HTTP headers:
> ...
> Authorization
> ...
> If you set a value for one of these reserved headers, the system may ignore the value you set, or overwrite it with its own value, or
> simply not send it. Moreover, the exact behavior may change over
> time. To avoid confusing problems like this, do not set these headers directly.

Code Details

The package manager has an authorization provider mechanism for URL requests:

When the `HTTPClient` is using the `URLSessionHTTPClient` as the underlying client: