Fix header validation per RFC 7230 and add null check

Address Copilot AI feedback:
- Remove underscore support from header names (RFC 7230 compliance)
- Add explicit null check for JSON parsing
- Update validation regex to /^[A-Za-z0-9-]+$/
- Add test case for null value handling
- Update documentation to clarify header name requirements

Changes:
- Header names now only accept alphanumeric characters and hyphens
- Improved error messages for invalid headers
- Added test for null JSON input
- Updated APIM example tests

All 81 tests passing.

src/helpers.ts

@@ -91,11 +91,11 @@ export function parseCustomHeaders(input: string): Record<string, string> {
     // Try JSON first (check if it starts with { or [)
     if (trimmedInput.startsWith('{') || trimmedInput.startsWith('[')) {
       const parsed = JSON.parse(trimmedInput)
-      if (typeof parsed !== 'object' || Array.isArray(parsed)) {
-        core.warning('Custom headers JSON must be an object, not an array')
+      if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        core.warning('Custom headers JSON must be an object, not null or an array')
         return {}
       }
-      return validateAndMaskHeaders(parsed)
+      return validateAndMaskHeaders(parsed as Record<string, unknown>)
     }
 
     // Try YAML
@@ -121,9 +121,9 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
   const sensitivePatterns = ['key', 'token', 'secret', 'password', 'authorization']
 
   for (const [name, value] of Object.entries(headers)) {
-    // Validate header name (basic HTTP header name validation)
-    if (!/^[a-zA-Z0-9\-_]+$/.test(name)) {
-      core.warning(`Skipping invalid header name: ${name} (only alphanumeric, hyphens, and underscores allowed)`)
+    // Validate header name (basic HTTP header name validation, RFC 7230: letters, digits, and hyphens)
+    if (!/^[A-Za-z0-9-]+$/.test(name)) {
+      core.warning(`Skipping invalid header name: ${name} (only alphanumeric characters and hyphens allowed)`)
       continue
     }