v0.2.0 — hardened config semantics

Closes the findings from an external review. Breaking for some 0.1.0 configs — all three are config-time schema errors with explicit messages, nothing changes silently at runtime:

• https url targets now require an explicit preserve_host. Upstream SNI follows whichever Host preserve_host selects, so the choice must be conscious; with the old default (true) an https target would silently handshake with the client's SNI.
• A templated host must pin a literal :port (e.g. http://$(header.X-Region).internal:8080$(uri)). Otherwise a header value like host.internal:9090 could choose the port on an allowlisted host — internal port-scanning through the gateway. Injected ports are rejected with 503 (asserted e2e).
• preserve_host is rejected on upstream targets, where it was silently ignored.

Also: hostnames may contain underscores (internal DNS), and luacheck joins CI.

Verified: 32 unit tests + 20-case e2e suite against Kong 3.9 (new case: injected port on an allowlisted host → 503).

Upgrade from 0.1.0

• Add preserve_host: true|false to every https url target (you almost always want false).
• Add a literal :port to any url whose host contains a variable.
• Remove preserve_host from upstream targets.