Spread the full options object through to clerkClient.authenticateRequest()
instead of re-destructuring a hand-picked subset. This closes the class of
bug where fields accepted by the ClerkMiddlewareOptions type (e.g.
organizationSyncOptions, skipJwksCache, headerType) were silently ignored
at runtime — same shape as the clockSkewInMs issue fixed in #8287.

Middleware-only keys (clerkClient, debug, frontendApiProxy) are peeled off
so they don't leak into the backend call.

… are set

The backend's createAuthenticateRequest factory pins apiUrl/apiVersion at
client construction time and overrides any runtime values. The Express
default ClerkClient singleton is built from env only, so passing apiUrl
or apiVersion to clerkMiddleware() was silently ignored on the default
path even after option-forwarding was generalized.

When the caller hasn't supplied a custom clerkClient but did pass apiUrl
or apiVersion, build a per-middleware ClerkClient with those values
instead of using the singleton.

…verride

Adds two regression tests:

- The per-middleware ClerkClient actually routes outbound API traffic to
  the apiUrl override, not just that createClerkClient was called with it.
  Spies on global fetch and asserts the URL hits the override host.

- The clerkMiddleware callback form (options as a function) also builds
  a per-middleware ClerkClient when the callback returns apiUrl.