Denial of service attack on the cube-api endpoint

An attacker can submit a specially crafted HTTP request to a Cube API endpoint. The request triggers an unhandled exception in the `contextToApiScopes` function or in an async handler that lacks proper error middleware fallback [CWE-20]. Because the error is not caught, the entire Cube API process becomes unavailable, resulting in a denial of service. No authentication is required if the endpoint is exposed to the public internet.

The vulnerability resides in the `@cubejs-backend/api-gateway` package. The patch addresses three issues: uncaught errors from `contextToApiScopes`, missing fallback to global error middleware for async handlers, and a removed `hasOwnProperty` check on the request object [patch_id=1640483][patch_id=1640482]. The exact file paths within the api-gateway package are not shown in the changelog diff.

The patch introduces three fixes in the api-gateway package: (1) catching errors from `contextToApiScopes` so they do not crash the process, (2) adding a fallback to the global error middleware for async handlers, and (3) removing a `hasOwnProperty` check on the request object that could cause unexpected failures [patch_id=1640483][patch_id=1640482]. Together these changes ensure that malformed input or runtime errors in request handling are properly caught and returned as error responses rather than crashing the API server.