Use X-goog-api-key header instead of URL parameter

[langsharpe]

Summary

Implements Google's recommended REST API authentication practice by using the X-goog-api-key header instead of passing the API key as a URL parameter.

Changes Made

• Authentication Enhancement: Added add_auth_header method to set X-goog-api-key header for API requests
• Client Updates: Modified get and post methods in GoogleMapsService::Client to use header authentication
• URL Generation: Updated generate_auth_url to exclude API key from URL parameters when using API key authentication
• Test Updates: Updated all API test specs to expect header-based authentication instead of URL parameters
• Backward Compatibility: Client ID authentication continues to work unchanged (still uses URL parameters and signatures)

Security Benefits

• Follows Google's current recommended authentication practices
• Reduces exposure of API keys in URLs and logs
• Aligns with modern REST API security standards

Testing

• All existing tests have been updated to validate header-based authentication
• Maintains full backward compatibility for client ID authentication
• No breaking changes to the public API interface

Reference

• Closes Use X-goog-api-key header instead of url param #3
• Implementation follows Google's REST API key usage guidelines

🤖 Generated with Claude Code