MetaMask#8843)

## Explanation

`RampsService.getBuyWidgetUrl` previously issued unauthenticated
requests to the ramps API (`/providers/<provider>/buy-widget`). The
upstream API is being gated behind authentication, so without a bearer
token the call will start to fail and break the Buy flow for every
consumer (mobile, extension).

This PR makes `getBuyWidgetUrl` authenticated by sourcing a bearer token
from `AuthenticationController` via the messenger and attaching it as an
`Authorization: Bearer <token>` header on the outgoing request.

**How it works:**

- A new private method `RampsService.#getRequestHeaders` calls the
messenger action `AuthenticationController:getBearerToken` and returns
the `Authorization` header. It is awaited once per `getBuyWidgetUrl`
invocation (verified by a new test) before the request is dispatched
through the existing `#policy.execute` wrapper, so token retrieval
happens outside the retry/circuit-breaker loop. If the token call
rejects (e.g. wallet is locked, user signed out), the rejection
propagates and no HTTP call is made — also covered by a new test.
- `RampsServiceMessenger`'s `AllowedActions` is widened from `never` to
`AuthenticationController.AuthenticationControllerGetBearerTokenAction`.
This is a **breaking change** to the messenger contract: consumers must
delegate the `AuthenticationController:getBearerToken` action into the
ramps messenger before calling `getBuyWidgetUrl`.
- The scope of the auth requirement is deliberately narrow — only
`getBuyWidgetUrl` is authenticated in this PR. Other endpoints (e.g.
`getGeolocation`) remain unauthenticated and explicitly do not request a
bearer token; this is locked in by tests that assert `getBearerToken` is
not called and that no `Authorization` header is sent for those
endpoints.

**Dependency added:**

`@metamask/profile-sync-controller@^28.1.0` is added as a runtime
dependency solely for its `AuthenticationController` type export (the
`AuthenticationControllerGetBearerTokenAction` action type). It is not
instantiated by `ramps-controller`; the implementing controller lives in
the consuming app and is wired up via the messenger.

**Demo:**


https://github.com/user-attachments/assets/87d4d146-1ce4-4582-a27a-4e60760fae7b


**Test updates:**

- Existing happy-path tests for `getBuyWidgetUrl` now assert the
`Authorization: Bearer mock-bearer-token` header is present on the nock
interceptor.
- New tests cover: bearer token is fetched exactly once per call;
rejection from `getBearerToken` short-circuits before any HTTP request;
and the scope assertion that `getGeolocation` remains unauthenticated.
- The `getRootMessenger`/`getService` test helpers now delegate the
`AuthenticationController:getBearerToken` action and expose a
`mockGetBearerToken` jest mock so individual tests can override the
resolution behavior.

## References

- Fixes
[TRAM-3502](https://consensyssoftware.atlassian.net/browse/TRAM-3502)
- Consumer adoption (mobile):
MetaMask/metamask-mobile#30319

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [x] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them


[TRAM-3502]:
https://consensyssoftware.atlassian.net/browse/TRAM-3502?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk due to a **breaking** messenger contract change requiring
consumers to delegate `AuthenticationController:getBearerToken`, and
because it changes how `getBuyWidgetUrl` performs network requests by
adding auth headers and failing early when tokens are unavailable.
> 
> **Overview**
> `RampsService.getBuyWidgetUrl` now authenticates buy-widget requests
by retrieving a bearer token via the messenger action
`AuthenticationController:getBearerToken` and sending `Authorization:
Bearer <token>` on the HTTP call.
> 
> This widens `RampsServiceMessenger` allowed actions (a **breaking
change** for consumers that must delegate/register the new action), adds
`@metamask/profile-sync-controller` as a runtime dependency for the
action type, updates TS project references, and extends tests to assert
auth header behavior, token fetch call counts, and that unrelated
endpoints (e.g. `getGeolocation`) remain unauthenticated.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bdad742. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Darius Costolas <10818970+meltingice1337@users.noreply.github.com>

## Explanation

Release 993.0.0 — two packages:

- **`@metamask/ramps-controller`** `13.3.1` → **`14.0.0`** (major)
- **`@metamask/transaction-pay-controller`** `22.6.1` → **`22.6.2`**
(patch)

`ramps-controller@14.0.0` ships MetaMask#8843, which authenticates
`getBuyWidgetUrl` by requiring `AuthenticationController:getBearerToken`
on its messenger. That's a breaking messenger-contract change, so major.

`transaction-pay-controller@22.6.2` is a no-code-change patch that bumps
its dep range on `ramps-controller` from `^13.3.1` to `^14.0.0`.
Included to keep the dependency graph current and avoid duplicate
`ramps-controller` copies in consumer node_modules. Its code doesn't
touch any of the breaking surface.

## References

- Feature PR: MetaMask#8843
- Mobile adoption (draft): MetaMask/metamask-mobile#30319

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [x] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Moderate risk because this release includes a **breaking**
`@metamask/ramps-controller` messenger-contract change requiring
consumers to delegate `AuthenticationController:getBearerToken` before
calling `getBuyWidgetUrl`. The rest is version/changelog/dependency
range updates with minimal runtime impact.
> 
> **Overview**
> Bumps the monorepo release version to `993.0.0` and publishes
`@metamask/ramps-controller` `14.0.0` (major) and
`@metamask/transaction-pay-controller` `22.6.2` (patch).
> 
> `ramps-controller@14.0.0` documents a **breaking** change requiring
`RampsServiceMessenger` consumers to delegate
`AuthenticationController:getBearerToken`, and adds bearer-token
authentication for `getBuyWidgetUrl` plus a new runtime dependency on
`@metamask/profile-sync-controller`.
> 
> `transaction-pay-controller@22.6.2` is a dependency-only update to
consume `@metamask/ramps-controller@^14.0.0`, with corresponding
`yarn.lock` updates.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
b8f2fe6. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Darius Costolas <10818970+meltingice1337@users.noreply.github.com>