feat: Add Lambda-Runtime-Invocation-Id support for cross-wiring protection

[vip-amzn]

Summary

Add Lambda-Runtime-Invocation-Id header support for cross-wiring protection.

The RIC now echoes the invocation ID received from RAPID on /next back on /response and /error, enabling RAPID to detect and reject stale responses from timed-out invocations.

Problem

On Lambda Managed Instances (LMI) and On-Demand (OD), when an invoke times out, the runtime process continues running in the background. If a new invoke arrives with the same requestId, RAPID accepts it. The still-running old invocation eventually posts its response, and RAPID matches it to the new invoke — delivering the wrong response (cross-wiring).

Solution

RAPID sends a unique per-invoke nonce via Lambda-Runtime-Invocation-Id header on /next. The runtime echoes it back on /response and /error. RAPID validates the match before accepting the response.

Changes

• runtime_client.cpp: Parse Lambda-Runtime-Invocation-Id from /next response, pass to post_success/post_failure via z format (accepts None → nullptr)
• lambda_runtime_client.py: Thread invocation_id through to native client
• bootstrap.py: Pass invocation_id from event request to response/error posting
• deps/patches/aws-lambda-cpp-add-invocation-id.patch: Patch aws-lambda-cpp to support invocation_id in get_next/do_post
• deps/patches/aws-lambda-cpp-musl-no-execinfo.patch: Extracted Alpine/musl fix from d3e9632 into a proper patch file so update_deps.sh can reproduce the tarball from scratch (previously baked directly into the tarball without a patch — see d3e9632)
• Unit tests: 6 new invocation-id specific tests + fix existing assertions for the new parameter

Backward Compatibility

Fully backward compatible in both directions:

• If RAPID doesn't send the header → RIC doesn't see it → doesn't echo → no behavior change
• If RIC doesn't echo it (old version) → RAPID skips validation → no behavior change

Testing

• 95 unit tests pass (includes 6 new invocation-id tests)
• E2E tested with updated RIE binary (validates invocation-id echo) and stock RIE (backward compat verified)
• Alpine 3.19 Docker build verified locally (musl/execinfo conditional compilation works)

[maxday]

All new tests all patch awslambdaric.lambda_runtime_client.runtime_client, so they verify Python-level argument threading, real value, but they stop one layer above the feature. The actual behavior lives in the C++ patch:

if (!invocation_id.empty()) {
    headers = curl_slist_append(headers, (std::string(INVOCATION_ID_HEADER) + ": " + invocation_id).c_str());
}

If someone re-rolls the tarball and drops aws-lambda-cpp-add-invocation-id.patch from update_deps.sh, all tests still pass and the feature silently disappears.

Can you add the following tests?

1. Round trip: /next returns Lambda-Runtime-Invocation-Id: abc123 → the subsequent /response request carries Lambda-Runtime-Invocation-Id: abc123.
2. Omission: /next sends no such header → /response carries no such header (not an empty one). This is the backward-compat claim.
3. Error path: same round trip via /error, since post_failure is a separate C++ overload.