fix(nginx,h2o): reject unknown HTTP methods with 405

[BennyFranciscus]

As requested in #98 — fixes the bad method validation failure for both nginx and h2o.

Problem

Both the nginx module and h2o accept any HTTP method (GETT, FOOBAR, etc.) and return 200, failing the validate.sh bad method check:

FAIL [bad method]: expected 4xx, got HTTP 200

Changes

nginx (ngx_http_httparena_module.c)

• Method guard at the top of the handler: only GET/HEAD/POST are allowed, everything else gets 405 Method Not Allowed
• Changed the final fallthrough from NGX_DECLINED (which passed to nginx default → 200) to a proper 404 Not Found for unknown paths

h2o (src/main.c)

• Added reject_bad_method() helper that checks for GET/HEAD/POST
• Applied it to all route handlers: pipeline, baseline11, baseline2, json, static, compression, db
• Upload handler already enforced POST-only so it was fine

Both return 405 for unknown methods, which satisfies the validate.sh 4xx check.

[joanhey]

@BennyFranciscus fix the validation for nginx-openresty, have the same problem.

[BennyFranciscus]

Good catch @joanhey — pushed a fix for nginx-openresty too. Added an access_by_lua_block at the server level that rejects anything other than GET/HEAD/POST with 405. Should cover all the routes without needing per-handler checks.