Issue Summary

Git LFS download action headers returned by a custom File Store plugin are discarded. This prevents Git LFS downloads from external stores that require authentication headers. Upload action headers are forwarded correctly.

The existing/bundled S3 implementation is unaffected because it uses presigned URLs and does not require GET headers.

Steps to Reproduce

1. Configure a custom File Store plugin that returns a header from generateGetUrl, for example:

return new GenerateGetUrlResponse.Builder(url)
  .header("Authorization", List.of("Bearer token"))
  .build();

1. Send a Git LFS batch request with the download operation.

1. Inspect the returned actions.download.header object.

Expected Results

The download action contains the headers supplied by the plugin:

"download": {
  "href": "https://example.com/lfs/object",
  "header": {
    "Authorization": "Bearer token"
  }
}

Actual Results

The download action contains an empty header object:

"download": {
  "href": "https://example.com/lfs/object",
  "header": {}
}

The headers are discarded by FileStoreAccessor.buildDownloadResponseAction, which constructs the response using Collections.emptyMap() instead of forwarding GenerateGetUrlResponse.getHeaders().

Workaround

Use a presigned URL or another URL-based authentication mechanism if the external store supports it.

If the external store requires authentication headers, currently there is no known workaround for this behavior.