…v2 (#5142)

`ApiGatewayRequestContextV2["authorizer"]` only declared the `iam` variant,
so reading the context of a Lambda (REQUEST) authorizer or a JWT authorizer
was a TypeScript error even though API Gateway populates those keys:

    ctx.env.event.requestContext.authorizer.lambda.userId
    // Property 'lambda' does not exist on type 'Authorizer'.

The payload format 2.0 event documented by AWS carries `authorizer.jwt`
with `claims` and `scopes`, and a Lambda authorizer's `context` object is
delivered under `authorizer.lambda`. Add both as optional properties,
mirroring `@types/aws-lambda`.

Types only — no runtime change, and `iam` is untouched, so this is
backwards compatible.

Closes #3281

…d close in cloudflare-workers websocket adapter (#5145)

#5161)

* test(secure-headers): cover combined CSP callbacks

* fix(secure-headers): isolate CSP callbacks by header

* update the tests

---------

Co-authored-by: Yusuke Wada <yusuke@kamawada.com>