Reject NUL paths in static file routing

[kyoungbinkim]

Summary

• Reject decoded paths containing NUL before static-file extension checks or filesystem access.
• Add a raw HTTP integration regression test so %00 is not re-encoded by HttpClient.

Reproduction and verification

• Without the guard, GET /main.cc%00.html returned HTTP 200 and the body contained int main from the non-allowlisted source file.
• With the guard, the same raw request returns HTTP 403 with an empty body; /index.html still returns HTTP 200.
• integration_test_client -r StaticFileRejectsNulPath: 3 assertions passed.
• Full MSVC build and CTest: 66/66 passed.

Fixes #2591