docs(authz): clarify daemon parsing semantics

Signed-off-by: mickael emirkanian <mickael.emirkanian@docker.com>

Author: mickael-docker

docs/extend/plugins_authorization.md

@@ -95,6 +95,12 @@ The Engine's authorization middleware fails closed: when a plugin returns an err
 the request is denied and the error is surfaced to the client. Plugins should also fail closed: if the plugin
 cannot confidently evaluate a request, it should return an error or `Allow: false`.
 
+> [!WARNING]
+> The plugin receives the [**raw** request body](#authzpluginauthzreq) from the daemon, so the
+> plugin must apply the same decoding semantics to ensure it is correctly evaluating
+> the request. The daemon decodes JSON **case-insensitively**, **last-one-wins**,
+> and does not reject duplicate or case-variant keys.
+
 ### Response body size and partial buffering
 
 The internal buffer that holds the response body between the daemon's HTTP