The resolver context includes the authorization header

The ```ctx.request.headers.authorization``` contains the exact authorization header that the client sent in the request.


This is a very sensitive information as that allows anybody who can read it to send requests impersonating the user with that token. And since it's included in the context, it's very easy to accidentally log them:

- A simple console.log leaks it:

```
export function request(ctx) {
console.log(ctx)
// ...
}
```

- Passing it to a Lambda, either via the ```payload``` or with a direct lambda resolver and then log the event (very common for debugging):

```
module.exports.handler = async (event) => {
console.log(event)
// ...
};
```

I think since the context already contains the ```identity``` with all important information about the caller, the authorization header should be removed or at least truncated.

Interestingly, AppSync resolver logging omits this:


And at the end of the request, it is truncated:


No repository file, test, or implementation entry point is identified in the issue. Start by reviewing the resolver context field ctx.request.headers.authorization and the documented identity and logging behavior. Done means the authorization token is no longer exposed in resolver context or is safely truncated, with coverage for resolver and Lambda logging paths.

Written by the indexing model from the issue text.