Accept a list of credentials in `httpCredentials` of `New Context` and `New Persistent Context`

Read Browser/utils/data_types.py around convert_typed_dict, then inspect Browser/keywords/playwright_state.py around _set_context_options and its New Context and New Persistent Context annotations. Add list handling while preserving per-entry secret resolution and direct-value checks; start by extending utest/test_secrets.py with resolved and rejected list cases. Done means both context keywords accept a list, a single dictionary still works, and the acceptance and logging cases described in the issue pass.

Use case

A test that talks to more than one server behind HTTP authentication needs different credentials per server. Typical cases: the application and its API on different hosts, or a staging site whose static assets come from a second protected host.

New Context httpCredentials= takes one username and password. With origin set, they are sent only to that origin; without it, to any server that asks. A second server with other credentials cannot be covered in the same context today. The only workaround is a second context, which does not help when one page loads from both servers.

Playwright 1.63 accepts an array of credentials, each with its own optional origin. The first entry whose origin matches the request is used, and an entry without origin matches any request.

Proposed keyword / arguments

No new keyword. httpCredentials of New Context and New Persistent Context accepts either one HttpCredentials dictionary, as today, or a list of them.

*** Test Cases ***
Log In To Application And API With Different Credentials
    VAR    &{app} =    username=$APP_USER    password=$APP_PASSWORD    origin=https://app.example.com
    VAR    &{api} =    username=$API_USER    password=$API_PASSWORD    origin=https://api.example.com
    VAR    @{credentials} =    ${app}    ${api}
    New Context    httpCredentials=${credentials}
    New Page    https://app.example.com
    Get Text    id=status    ==    Data loaded from API

Secret resolution works per entry, the same way it works for a single dictionary today: $var and %ENV placeholders, Robot Framework 7.4 Secret values and crypt: strings from CryptoLibrary. The rule that direct values are refused applies to every entry, so a list that contains one entry with plain values fails with the existing "Direct assignment of values or variables as 'httpCredentials' is not allowed" error.

New Page does not take context options, so it is not affected.

browserContext.setHTTPCredentials() changes the credentials of an open context. Playwright deprecated it earlier and un-deprecated it in 1.63, and it accepts the same list. This issue does not propose a keyword for it. Playwright notes that browsers may cache credentials per origin after a successful authentication, so changing them mid-test may have no effect; a new context is the reliable way to switch users. A setter can be reconsidered if someone shows a case that a new context does not cover.

Playwright API

• browser.newContext({ httpCredentials }): httpCredentials is an object or, since 1.63, an array of objects with username, password, optional origin and optional send. In types.d.ts of 1.63.0 the type changes from {...} to {...}|Array<{...}>; 1.62.0 has only the object form.
• browserType.launchPersistentContext(userDataDir, { httpCredentials }): same change in 1.63.
• browserContext.setHTTPCredentials(httpCredentials): the @deprecated tag is gone in 1.63 and the parameter is null|{...}|ReadonlyArray<{...}>.

send applies only to requests from an APIRequestContext, not to requests from the browser. Our HttpCredentials TypedDict does not have it today and does not need it for this change.

Implementation notes

All references are to upstream main (5e350998).

Python:

• Browser/utils/data_types.py:804-840: _HttpCredentials (required username, password, both str | Secret) and HttpCredentials (optional origin). The TypedDict stays as it is. Its docstring gets a list example and the "first matching origin wins" rule.
• Browser/keywords/playwright_state.py:815 (New Context) and :1028 (New Persistent Context): annotation HttpCredentials | None becomes HttpCredentials | list[HttpCredentials] | None. That stays within the narrow-annotation rule: it names the TypedDict, not dict or Any. The httpCredentials lines of both docstrings (:880-882, and the Secret paragraph at :961-971) get the list form.
• Browser/utils/data_types.py:114-147 convert_typed_dict: for a union it picks the TypedDict member and then raises TypeError when the value is not a dict (:126-129). It needs to convert each item of a list value with the same TypedDict.
• Browser/keywords/playwright_state.py:1218-1220 in _set_context_options calls self.resolve_secret(httpCredentials, "httpCredentials") on the raw keyword argument, not on the converted params value. resolve_secret (Browser/base/librarycomponent.py:248-257) goes through _replace_placeholder_variables (:297-302), which resolves the values of a dict but returns any other value unchanged. A list would therefore come back equal to the input and hit the "Direct assignment" ValueError at :251-256. The fix is to resolve each entry separately in _set_context_options (one resolve_secret call per entry), so the equality check stays per entry. resolve_secret itself does not need to know about lists.
• _mask_credentials (playwright_state.py:1272-1275) replaces the whole value with "XXX", so a list is masked in the log without change.

Node: none. newContext (node/playwright-wrapper/playwright-state.ts:1024-1042) and newPersistentContext (:1106-1115) pass the parsed rawOptions to Playwright as they are. No proto change.

Tests:

• utest/test_secrets.py:123-130 already checks the resolved single dict in the raw options sent to Node; add the same for a list of two entries (both resolved), and a list where one entry has direct values (fails).
• Acceptance: the Test App (node/dynamic-test-app/src/server.ts) has no route that answers with 401 and WWW-Authenticate. Add one that checks Basic credentials, and reach it through localhost and 127.0.0.1 as two origins, the same trick atest/test/01_Browser_Management/storage_state.robot:7 uses (${OTHER_ORIGIN_URL}). One test with a list of two entries, each origin getting its own credentials. Extend atest/test/01_Browser_Management/no_httpCredentials_logging.robot with a list case to keep the log masking covered.

Backwards compatibility

Additive. A single dictionary keeps working and is passed to Playwright unchanged. The list form needs Playwright 1.63 or later; the library already ships 1.65.