feat: add lambda-runtime-invocation-id header

[darklight3it]

Summary

Add Lambda-Runtime-Invocation-Id header support for cross-wiring protection.

The RIC now echoes the invocation ID received from RAPID on /next back on /response and /error, enabling RAPID to detect and reject stale responses from timed-out invocations.

Problem

On Lambda Managed Instances (LMI) and On-Demand (OD), when an invoke times out, the runtime process continues running in the background. If a new invoke arrives with the same requestId, RAPID accepts it. The still-running old invocation eventually posts its response, and RAPID matches it to the new invoke — delivering the wrong response (cross-wiring).

Solution

RAPID sends a unique per-invoke nonce via Lambda-Runtime-Invocation-Id header on /next. The runtime echoes it back on /response and /error. RAPID validates the match before accepting the response.

Backward Compatibility

Fully backward compatible in both directions:

• If RAPID doesn't send the header → RIC doesn't see it → doesn't echo → no behavior change
• If RIC doesn't echo it (old version) → RAPID skips validation → no behavior change

Testing

• added unit test
• added a new dockerized test working with the new RIE.

[vip-amzn]

This is not testing the invocation id cross wiring situation. the assertion is on request id, which is going to be the same. But we want to check that response is coming appropriately.

batches = [
    [Request.create(
        payload={"command": "invoke-A", "sleep": TIMEOUT + 2},
        assertions=[{"transform": ".errorType", "error": "Sandbox.Timedout"}],
        headers={"X-Amzn-RequestId": SAME_REQUEST_ID},
    )],
    [Request.create(
        payload={"command": "invoke-B", "sleep": TIMEOUT - 1},
        assertions={"response": {"from": "invoke-B"}},   
        headers={"X-Amzn-RequestId": SAME_REQUEST_ID},
    )],
]