fix(http-provider): don't double-encode a templated JSON body

[dngr2]

Fixes #6547

The bug

_query() normalises headers when they arrive as a string:

if isinstance(headers, str):
    headers = json.loads(headers)

but never does the same for body, which is then handed to requests as json=body. A workflow using a templated body renders to a JSON string:

- name: http-request
  provider:
    type: http
    with:
      url: "http://host:port"
      method: POST
      headers:
        Content-Type: "application/json"
      body: "{{ alert }}"

json= serialises it a second time, so the endpoint receives a quoted string instead of an object — with a Content-Type: application/json header that no longer describes the payload.

The fix

Parse a string body before sending, mirroring the headers handling three lines above.

Two details worth flagging for review:

• Only an object or array is accepted. json.loads("123") does not raise — it returns an int. Converting a body of "123" into a number would be a silent change, so a bare scalar is left as text.
• The ValueError catch is deliberate. This module imports JSONDecodeError from requests.exceptions, which is a subclass of the one json.loads raises, so catching it would not work here.

A body that is still a string afterwards goes out as data= with the caller's Content-Type, since json= would re-serialise it.

Behaviour change

This changes what reaches the endpoint for anyone currently sending a JSON string and compensating for the double encoding downstream. I believe the current behaviour is the bug rather than the contract, since it contradicts both the declared Content-Type and the handling of headers in the same function — but flagging it explicitly since it is the kind of thing that can bite silently.

Tests

New file: tests/providers/http_provider/test_http_provider_json_body.py

Written before the fix and run against unmodified main: 7 failed, 5 passed. With the fix: 12 passed. The 5 that passed throughout are the regression guards, which is the point of them.

• templated and nested JSON strings, on POST / PUT / DELETE
• plain text and XML bodies sent as data, not JSON-encoded
• a bare numeric string not treated as JSON
• regression guards: dict, list and None bodies unchanged

tests/providers in full: 65 passed. I have not run the suites needing Docker and a database locally — leaving those to CI.

---

Touches the same file as #6687 but different lines; whichever lands first, I am happy to rebase the other.