Include allowed methods in 405 responses

[OskarEichler]

Summary

Unsupported request methods receive a 405 response with Allow: GET, HEAD.

Add the required Allow response header using Rack-version-appropriate casing. RFC 9110 §15.5.6 requires a 405 response to identify the supported methods. The existing 18-byte response body and Content-Length are already correct and remain unchanged. This does not change HEAD response handling.

Reproduction

With require "sprockets"; require "tmpdir":

env = Sprockets::Environment.new
status, headers, body = env.call({"REQUEST_METHOD"=>"POST", "PATH_INFO"=>"/entry.js"})
p status # 405
p headers.find { |name, _| name.downcase == "allow" }&.last
# "GET, HEAD"; previously nil.

Verification

• Isolated patch: unchanged bundle exec rake test and bundle exec rake test_isolated each pass 913 tests / 4,109 assertions / zero failures/errors / four skips, on Ruby 3.2.11 and 4.0.6 with Rack 3.2.7.
• 35 focused external checks pass on each Ruby. Baseline reproduces the defect. All Ruby commands used rbenv.
• Full RuboCop: 133 files, zero offenses. Changed Ruby files pass syntax checks on both Rubies; git diff --check passes.
• Gem build and content comparison preserve all 84 package paths, version 4.4.1, Ruby >=2.5 and dependency metadata. Only README, CHANGELOG and the relevant runtime files differ.
• Rack 2.2.24 / Ruby 3.2.11: focused checks pass. Full existing suite has the same preexisting conditional-ETag fixture error on baseline and patch (HTTP_IF_NONE_MATCH is nil at test_server.rb:94); not represented as a passing suite.

Compatibility and limitations

Breaking changes: no intended change to valid supported behavior; the incorrect behavior described above changes. No new dependencies or version upgrades. Nested configuration ownership, unrelated cache invalidation and HTTP behavior are outside this focused patch.

Based on installed release/current upstream main 49d9f20c00ac7d9a7ee57db058961edcccd86699. This is an upstream-only contribution; no personal fork is being adopted in the application. Older Ruby/Linux/JRuby verification is left to upstream CI, not claimed locally. No checked-in tests were added or edited under the requesting repository's no-test-edit policy; focused reproductions ran externally. Prepared with AI assistance. This does not claim exhaustive Sprockets coverage.