Validate request headers against configured auth methods (Bearer, API Key,
Basic, Custom) in order. Returns true if any configured method accepts
the request, or if no methods are configured and allowUnauthenticated
is not false.
The request headers as a string-keyed record. The method checks both
lowercase and title-case header names (e.g., authorization and
Authorization).
Promise<boolean> — true if the request is authorized.