OTWO-7721 Enforce API key authentication on JSON format requests

[bd-vaibhav]

No description provided.

[Copilot]

Pull request overview

Updates API authentication enforcement so JSON-format requests (in addition to XML) require an API key unless a user is logged in, aligning controller behavior with the goal of protecting JSON responses.

Changes:

• Replace the XML-only API access filter with a unified verify_api_access filter that handles both XML and JSON.
• Enforce API key checks for JSON requests (with an explicit exception for logged-in users).
• Expand controller test coverage to assert JSON authentication behavior for AccountsController#show.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/controllers/accounts_controller_test.rb	Adds/adjusts tests to require API keys for anonymous JSON show, while allowing logged-in JSON access.
app/controllers/stacks_controller.rb	Switches project_stacks to the new unified API access filter.
app/controllers/sitemap_controller.rb	Updates the skip hook to match the renamed unified API access filter.
app/controllers/kudos_controller.rb	Switches index/sent to the new unified API access filter.
app/controllers/application_controller.rb	Replaces XML-only gating with a unified XML/JSON verify_api_access implementation (with JSON session exception).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.