feat: introduce Go 1.27 edge adapters, authentication and authorization

[ajbeck]

Introduces the initial Go 1.27 module, with root package edge, so applications can serve API Gateway requests through ordinary net/http handlers and compose explicit authentication and authorization. Module-owned JSON uses encoding/json/v2 directly.

Scope

• Buffered REST proxy and HTTP API payload 1.0/2.0 adapters, with raw invocation and typed SDK entry points.
• Separate REST response streaming with incremental delivery, backpressure, cancellation, cleanup and sanitized terminal errors.
• Immutable caller/claims APIs, opt-in gateway assertions, strict action-header selection and sanitized invocation errors.
• Cognito access-token verification and an audience-bound IAM GetCallerIdentity proof generator/verifier, allowing Bearer or EdgeIAM credentials on the same application route.
• Deny-by-default authorization rules and consumer-owned resource/grant resolution, demonstrated by a complete orders dispatcher with native, buffered and streaming entry points.
• Contract tests, fixtures, benchmarks, support guides and recorded design decisions.
• PR validation against main and Release Please with GitHub App authentication, reusable main validation and an initial v0.1.0 release policy.

Validation

Local Go 1.27.1 validation passed: full race tests, vet, module verification, formatting, the external-consumer check, and CGO-disabled Linux arm64/amd64 builds. Both workflows pass actionlint; release configuration validates against the schema bundled with the pinned Release Please action. This PR runs the Go 1.27.0/latest 1.27 CI matrix.

Release qualifications

REST streaming's deployed AWS interoperability remains unverified: local SDK probes expose mode-header and connection-handling differences from AWS guidance. Cognito/STS integration fixtures are local and synthetic; no live AWS test or deployment is claimed. The license choice and release App installation/permissions still require confirmation before publication. The App Client ID variable and private-key Actions secret have been provisioned.

Merging this implementation starts release preparation after main validation; merging the subsequent generated release PR is the publication decision. No release is requested by this PR.