fix(security): fix ExtraHeaders bug and add HTTP client timeout

[lakhansamani]

Summary

• ExtraHeaders bug (HIGH): Fixed NewAuthorizerClient to use the enriched headers map (with x-authorizer-url and x-authorizer-client-id) instead of the raw extraHeaders parameter. Previously, default headers were never sent with requests.
• HTTP timeout (MEDIUM): Added 30-second timeout to http.Client in GraphQL requests to prevent indefinite hangs.

Files Changed

• client.go — ExtraHeaders assignment fix
• graphql.go — HTTP client timeout

Test plan

• Verify SDK requests include x-authorizer-url and x-authorizer-client-id headers
• Verify requests timeout after 30 seconds when server is unresponsive