Curl the function URL before assuming 403 persists

When a function URL 403 is reported, curl it and read the response headers before changing the policy. A response carrying x-amzn-Remapped-* headers or app headers such as x-powered-by shows Lambda actually ran the function, so authorization passed. If the policy has both statements and curl succeeds but a browser still shows 403, suspect a different function or account, or a cached 403 in the browser or CloudFront.