feat(api): Pass authorization in header instead of query parameter for API category

[mattcreaser]

• PR title and description conform to Pull Request guidelines.

Issue #, if available:

Description of changes:
AppSync now supports passing the authorization headers as HTTP headers instead of query string parameters when establishing a websocket connection.

This PR migrates the API category to the new, recommended method for passing authorization headers.

How did you test these changes?

• Manual test
• Integration tests

Documentation update required?

• No
• Yes (Please include a PR link for the documentation update)

General Checklist

• Added Unit Tests
• Added Integration Tests
• Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 44.03%. Comparing base (7f874ed) to head (3689636).
Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2918      +/-   ##
==========================================
+ Coverage   44.01%   44.03%   +0.01%     
==========================================
  Files         926      932       +6     
  Lines       30485    30689     +204     
  Branches     4351     4496     +145     
==========================================
+ Hits        13419    13513      +94     
- Misses      15601    15693      +92     
- Partials     1465     1483      +18