Deny all Mutations in aws_lambda auth

Hey,

I'm trying to create a simple API key based authentication system in AppSync using the AWS_LAMBDA authentication type.

This should allow read only access to the API. I was hoping a Lambda authorizer like this would work, but its not denying Mutations as expected.

This is a rough example of the Authorizer lambda code:

```
def lambda_handler(event, context):
token = event.get('authorizationToken')
if not token:
raise Exception('Unexpected token format')
response = {
'isAuthorized': True,
'deniedFields': ['Mutation']
}
```

I've tried things like `Mutation.*` and `schema.Mutation` but can't get it to work. This seems like a very common use case, is there a way to get it working?

No repository files or tests are identified. Start from the Lambda authorizer entry point, `lambda_handler`, and verify how AWS AppSync interprets the `isAuthorized` and `deniedFields` values for the `Mutation` entry point. Done means establishing whether the requested read-only authorization behavior is supported and documenting or correcting the relevant behavior.

Written by the indexing model from the issue text.