fix(egress): atomic URL+headers rotation and Kotlin binary compat

- Make URL and headers rotation atomic: skip URL update when headers
  validation fails, preventing bootstrap header leakage to new URL
- Add source(InlineCredentialSource) and source(HTTPCredentialSource)
  overloads to Kotlin Credential.Builder for binary compatibility
  with existing callers compiled against the previous SDK

Author: Pangjiping

components/egress/pkg/credentialvault/source_http.go

@@ -145,17 +145,19 @@ func (s *httpSource) fetch(ctx context.Context) (string, error) {
 	}
 	urlValid := result.URL == "" || validateHTTPSourceURL(result.URL) == nil
 	headersValid := result.Headers == nil || validateHTTPSourceHeaders(result.Headers) == nil
-	if urlValid && result.URL != "" {
-		s.nextURL = result.URL
-		if result.Headers == nil {
-			s.nextHeaders = nil
+	if urlValid && headersValid {
+		if result.URL != "" {
+			s.nextURL = result.URL
+			if result.Headers == nil {
+				s.nextHeaders = nil
+				s.headersRotated = true
+			}
+		}
+		if result.Headers != nil {
+			s.nextHeaders = result.Headers
 			s.headersRotated = true
 		}
 	}
-	if urlValid && headersValid && result.Headers != nil {
-		s.nextHeaders = result.Headers
-		s.headersRotated = true
-	}
 	s.mu.Unlock()
 
 	return result.Value, nil

sdks/sandbox/kotlin/sandbox/src/main/kotlin/com/alibaba/opensandbox/sandbox/domain/models/sandboxes/CredentialVaultModels.kt

@@ -172,6 +172,16 @@ class Credential private constructor(
             return this
         }
 
+        fun source(source: InlineCredentialSource): Builder {
+            this.source = source as CredentialSource
+            return this
+        }
+
+        fun source(source: HTTPCredentialSource): Builder {
+            this.source = source as CredentialSource
+            return this
+        }
+
         fun inlineSource(value: String): Builder {
             this.source = InlineCredentialSource.of(value)
             return this