Fix the bypass finder for a cached Lambda authorizer

Your Lambda authorizer kept the decoded token in a module scope variable, to skip checking it again on warm invocations. It only verified a token when that variable was empty. So after the first caller, every request on the same warm container ran as that first caller, and a pentester used it to get admin rights. You replay a stream of requests through that cached authorizer to find each request it served as the wrong user.

An assistant wrote find_identity_bypasses(token_subjects). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• token_subjects: the subject of the token each request presents, in arrival order, all on one warm container. The subject is the user the token belongs to, as a string. "" means the request has no usable subject.
• Return a list of integers: the indexes of the requests the authorizer served as someone else, in increasing order.

Rules the tests check:

• The cache starts empty.
• While the cache is empty, a request is served as itself, so it is never in the result. If its subject is not "", that subject goes into the cache. A "" subject leaves the cache empty.
• Once the cache holds a subject, it never changes, and every later request is served as that subject.
• A request served as the cached subject is in the result when its own subject is not exactly equal to the cached one. Case matters.
• "" is a subject like any other here, except that it never fills the cache.
• An empty token_subjects returns an empty list.