Extend Custom Authorizer Support API Gateway Request Parameter

I noticed that the custom authorizer implementation makes the assumption that authorization will come strictly from the header. Specifically, the CustomAuthorizer only allows `header`:

https://github.com/aws/chalice/blob/cb3059551da903accff7d91d710fc998adfc1289/chalice/app.py#L203-L212

And the local server assumes type `TOKEN` and a header of `authorization`:
https://github.com/aws/chalice/blob/cb3059551da903accff7d91d710fc998adfc1289/chalice/local.py#L382-L385

However, the [API Gateway Lambda Authorization](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html) documentation specifies:

> When a client calls your API, API Gateway verifies whether a Lambda authorizer is configured for the API method. If so, API Gateway calls the Lambda function. In this call, API Gateway supplies the authorization token that is extracted from a specified request header for the token-based authorizer, **or passes in the incoming request parameters as the input** (for example, the event parameter) to the request parameters-based authorizer function.

And the specific line of note is: **or passes in the incoming request parameters as the input**. So the change would be to allow either `TOKEN` or `REQUEST` types. Obviously more details need to be ironed out, but I wanted to start a discussion first.

What do others think of this extension?

Read the CustomAuthorizer definition in chalice/app.py around lines 203-212 and the local authorizer handling in chalice/local.py around lines 382-385, then compare their assumptions with the API Gateway Lambda Authorization documentation. Define the supported TOKEN and REQUEST behavior and identify the tests needed to verify both request types before implementation.

Written by the indexing model from the issue text.