fix: move API token injection to GlobalOutbound via props - #28

Summary

• Moves API token injection from the dynamic worker isolate to GlobalOutbound via the props mechanism
• GlobalOutbound now accepts { apiToken: string } props and injects the Authorization header on allowed outbound requests
• The dynamic worker code no longer receives or references the API token — typeof apiToken is undefined inside user code
• Prevents token theft via globalThis.fetch proxy attacks since the token is added outside the user code isolate

Test plan

• typeof apiToken returns undefined in user code
• cloudflare.request() still works (REST + GraphQL)
• Fetch proxy attack (globalThis.fetch = ...) returns null for captured Authorization header
• Outbound fetch to non-CF domains still blocked
• All 69 unit tests pass
• npm run format clean
• Deployed and verified on staging