fix(router): inherit OAC protection for URL routes

[omercnet]

Summary

• propagate the Router's normalized protection configuration to URL routes
• enable Lambda Origin Access Control only for genuine Lambda Function URL origins
• force HTTPS for signed Lambda origins and keep ordinary URL routes unchanged
• add focused regression coverage for protected, unprotected, and spoofed origins

Verification

• bun run --cwd platform test -- test/components/router-url-route.test.ts
• bun run typecheck:platform
• bun run build:platform

Closes #6881