Allow/use authentication credentials when fetching a sitemap

[wwilsman]

Typically, sitemaps are SEO tools used to tell search engines what web pages of a site are accessible. However, it sometimes makes sense for private apps/site to include a sitemap (likely via an included or added plugin). These sitemaps need to be fetched with authentication headers for a successful response. We should use existing discovery auth headers and also maybe allow additional configuration in case sitemap auth differs from discovery auth (CLI flag or sitemap config entry?).