feat: send WAF bypass header when env var is set

[MagentaManifold]

Because:

• we need a way to send WAF header to bypass rate limiting in CI environments.

This commit:

• sends fxa-ci=CI_WAF_TOKEN in header

Closes FXA-13608

[Copilot]

Pull request overview

Adds support for injecting a CI-specific WAF bypass header into all APIClient requests when CI_WAF_TOKEN is present in the environment, to help avoid rate-limiting in CI (FXA-13608).

Changes:

• Injects fxa-ci: <CI_WAF_TOKEN> into the underlying requests.Session headers during APIClient initialization.
• Adds unit tests validating that the header is present/absent depending on the environment variable.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
fxa/_utils.py	Injects the fxa-ci header into APIClient when CI_WAF_TOKEN is set.
fxa/tests/test_core.py	Adds TestAPIClientWAFHeader to verify the env-var-driven header behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[toufali]

This looks good!

I read copilot's notes and actually preferred the other suggestion -- mutating the session if env var is present and var not already set. Majority of cases will want this, and we added safe-guards.

I also added a bypass for the unrelated failing live-server tests as discussed in mtg -- likely a result of feature drift or lack of maintenance on this repo.