[Bridge] Told the Nexus handler the caller namespace.

[moetemp]

What changed?

This PR tells the Nexus handler the caller namespace on ExecuteSyncNexusOperation.

• The frontend sets the Nexus header temporal-caller-namespace to the authorized request namespace.
• A request that sets the header in nexus_header gets InvalidArgument, in any case spelling.
• The Nexus HTTP route removes the header before dispatch. The Workflow caller and the standalone operation reach the handler through that route, so no path can forge the value.

Why?

The stream service's authorize hook can then key its rules on a verified caller (DD-164 in the direct reads design). Python shows the value as StreamAccess.caller_namespace.

The design leaves the HTTP route unchanged. That's not enough, because a client of the HTTP route, or a Workflow's nexus_header, could set the header too. So this PR removes it there. Setting it on the Workflow path later is a change in the same place.

How did you test it?

Link to a test plan if any -

• Unit Tests
• Staging
• End to End Tests

Unit tests in service/frontend/nexus_sync_test.go and nexus_handler_test.go. Functional tests in tests/nexus_sync_test.go check that the handler sees the caller namespace, that a client value is refused, and that the HTTP route removes a forged value.