Add JSON-field auth token extraction and additional header support to ServiceDeployer

[nolanmurphey]

Summary

Addresses Tier 1 of #103 by adding two opt-in registration options to the Restate ServiceDeployer:

• authTokenJsonField — when the auth-token secret holds a JSON object
  (e.g. {"token":"rst_xxx","version":3}), extract the bearer token from the
  named top-level field instead of using the whole secret string. Extraction
  happens inside the custom-resource handler, so the plaintext token never
  becomes a CloudFormation property.
• additionalHeaders — static headers added to every Restate admin API
  request (health check, registration, visibility patch, pruning). They are
  spread last, so they take precedence over the headers the handler sets itself
  (Authorization, Content-Type, Accept), allowing a caller to override
  them when a proxy or gateway in front of the admin endpoint requires it.

Both options are only forwarded to the custom resource when set, so existing
users see no CloudFormation property diff.

This covers the structured-secret extraction and header-injection parts of #103 (Tier 1).

Changes

• lib/restate-constructs/service-deployer.ts — new props on
  ServiceRegistrationProps, forwarded to the custom resource only when set.
• lib/restate-constructs/register-service-handler/index.mts —
  createAuthHeader → buildBaseHeaders; spreads extra headers last (caller
  wins) and performs secret-safe JSON-field extraction (never echoes secret
  material on error).
• test/restate-constructs.test.ts — new tests: forward-when-set and
  omit-when-unset for both options.
• Updated handler bundle snapshot.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}