fix: Ensure authentication is required for all A2A methods except the .well-known URI

Author: fjuma

reference/grpc/src/main/java/io/a2a/server/grpc/quarkus/QuarkusGrpcHandler.java

@@ -9,8 +9,10 @@
 import io.a2a.transport.grpc.handler.CallContextFactory;
 import io.a2a.transport.grpc.handler.GrpcHandler;
 import io.quarkus.grpc.GrpcService;
+import io.quarkus.security.Authenticated;
 
 @GrpcService
+@Authenticated
 public class QuarkusGrpcHandler extends GrpcHandler {
 
     private final AgentCard agentCard;

reference/jsonrpc/src/main/java/io/a2a/server/apps/quarkus/A2AServerRoutes.java

@@ -51,6 +51,7 @@
 import io.a2a.spec.UnsupportedOperationError;
 import io.a2a.transport.jsonrpc.handler.JSONRPCHandler;
 import io.a2a.util.Utils;
+import io.quarkus.security.Authenticated;
 import io.quarkus.vertx.web.Body;
 import io.quarkus.vertx.web.ReactiveRoutes;
 import io.quarkus.vertx.web.Route;
@@ -81,6 +82,7 @@ public class A2AServerRoutes {
     Instance<CallContextFactory> callContextFactory;
 
     @Route(path = "/", methods = {Route.HttpMethod.POST}, consumes = {APPLICATION_JSON}, type = Route.HandlerType.BLOCKING)
+    @Authenticated
     public void invokeJSONRPCHandler(@Body String body, RoutingContext rc) {
         boolean streaming = false;
         ServerCallContext context = createCallContext(rc);

reference/rest/src/main/java/io/a2a/server/rest/quarkus/A2AServerRoutes.java

@@ -8,6 +8,7 @@
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Function;
 
+import jakarta.annotation.security.PermitAll;
 import jakarta.enterprise.inject.Instance;
 import jakarta.inject.Inject;
 import jakarta.inject.Singleton;
@@ -23,6 +24,7 @@
 import io.a2a.transport.rest.handler.RestHandler;
 import io.a2a.transport.rest.handler.RestHandler.HTTPRestResponse;
 import io.a2a.transport.rest.handler.RestHandler.HTTPRestStreamingResponse;
+import io.quarkus.security.Authenticated;
 import io.quarkus.vertx.web.Body;
 import io.quarkus.vertx.web.ReactiveRoutes;
 import io.quarkus.vertx.web.Route;
@@ -38,6 +40,7 @@
 import java.util.Set;
 
 @Singleton
+@Authenticated
 public class A2AServerRoutes {
 
     @Inject
@@ -249,6 +252,7 @@ public void deleteTaskPushNotificationConfiguration(RoutingContext rc) {
      * @param rc
      */
     @Route(path = "/.well-known/agent-card.json", order = 1, methods = Route.HttpMethod.GET, produces = APPLICATION_JSON)
+    @PermitAll
     public void getAgentCard(RoutingContext rc) {
         HTTPRestResponse response = jsonRestHandler.getAgentCard();
         rc.response()