fix: guard against null in DetokenizeRequest.downloadUrl(null)

Calling .downloadUrl(null) previously stored null in the field, creating
an NPE risk for callers who read getDownloadUrl() back without a null
check. Now null -> false (matching the default), consistent with the
continueOnError(null) guard in the same builder.

Added test: testDetokenizeRequestDownloadUrlNullTreatedAsFalse

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: Devesh-Skyflow

src/main/java/com/skyflow/vault/tokens/DetokenizeRequest.java

@@ -67,7 +67,7 @@ public DetokenizeRequestBuilder downloadURL(Boolean downloadURL) {
         }
 
         public DetokenizeRequestBuilder downloadUrl(Boolean downloadUrl) {
-            this.downloadUrl = downloadUrl;
+            this.downloadUrl = downloadUrl != null && downloadUrl;
             return this;
         }
 

src/test/java/com/skyflow/vault/controller/VaultControllerTests.java

@@ -291,4 +291,12 @@ public void testDetokenizeRequestDownloadUrlDefaultIsFalse() {
         Assert.assertFalse("downloadUrl should be false by default", request.getDownloadUrl());
     }
 
+    @Test
+    public void testDetokenizeRequestDownloadUrlNullTreatedAsFalse() {
+        DetokenizeRequest request = DetokenizeRequest.builder()
+                .downloadUrl(null)
+                .build();
+        Assert.assertFalse("null downloadUrl should default to false — no NPE risk", request.getDownloadUrl());
+    }
+
 }