fix: do not implicitly allow OPTIONS in isMethodAllowed

[lihan3238]

Summary

• Remove the special case in isMethodAllowed that always allows OPTIONS requests regardless of AllowedMethods configuration
• Non-preflight OPTIONS requests are now subject to the same method check as other HTTP methods
• Preflight handling is unaffected since handlePreflight checks Access-Control-Request-Method, not the OPTIONS method itself

Test Changes

• Updated TestIsMethodAllowedReturnsTrueWithOptions to TestIsMethodAllowedRejectsOptionsByDefault: verifies OPTIONS is rejected when not in AllowedMethods
• Added TestIsMethodAllowedAllowsOptionsWhenExplicit: verifies OPTIONS is allowed when explicitly listed
• Updated NonPreflightOptions test: now expects no CORS headers when OPTIONS is not in AllowedMethods
• Added NonPreflightOptionsAllowed test: verifies CORS headers are set when OPTIONS is explicitly in AllowedMethods

Closes #37

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com