…-handler overloads (#4865)

The 9- and 10-handler `app.on` overloads declared `R` on the last handler position but discarded it, hardcoding `MergeTypedResponse<HandlerResponse<any>>` in the schema instead. This caused the inferred `output` to collapse to `{} | Promise<void>` regardless of what the response handler returned.

  Affected overloads:
  - app.on(method,   path, handler x10)
  - app.on(method[], path, handler x9)
  - app.on(method[], path, handler x10)

  The 8-handler variants were already using `MergeTypedResponse<R>` correctly.

…4883)

* fix(aws-lambda): handle invalid header names in request processing

Co-authored-by: Taku Amano <[email protected]>

* ci: apply automated fixes

---------

Co-authored-by: Taku Amano <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix(jsx): validate attribute names to prevent XSS via key injection

* fix(jsx/dom): handle invalid attribute names in DOM renderer