fix: deduplicate Allow header methods in 405 responses

[LeSingh1]

Problem

When multiple overlapping parameterized route patterns all register the same HTTP method, a request with an unregistered method produces duplicate entries in the Allow response header.

Minimal reproduction (from #996):

r.Post("/article/1-2-3", ...)
r.Post("/article/{a}", ...)
r.Post("/article/{b}-{c}", ...)
r.Post("/article/{b}-{c}-{d}", ...)

// GET /article/1-2-3 → 405 with Allow: POST, POST, POST, POST

Each parameterized node that matched during route traversal independently appended POST to rctx.methodsAllowed []methodTyp. The methodNotAllowedHandler then wrote one Allow header value per slice entry — one per matched node — instead of one per distinct method.

Fix

Replace methodsAllowed []methodTyp in Context with a methodTyp bitmask. Since methodTyp is already defined as a bitmask of power-of-two constants, each candidate node can OR its methods into the bitmask (rctx.methodsAllowed |= endpoints) rather than append to a slice. methodNotAllowedHandler then iterates reverseMethodMap and emits one Allow header entry for each bit that is set — guaranteeing uniqueness without any extra allocation.

Changes

• context.go: methodsAllowed []methodTyp → methodsAllowed methodTyp; Reset() zeroes with = 0
• tree.go: two append(rctx.methodsAllowed, ...) → rctx.methodsAllowed |= endpoints
• mux.go: MethodNotAllowedHandler and methodNotAllowedHandler take a single methodTyp bitmask instead of ...methodTyp; handler iterates reverseMethodMap by bitmask
• mux_test.go: TestMethodNotAllowedNoDuplicates — regression test from the exact scenario in Duplicate HTTP methods in 405 Allow header #996

Test plan

• TestMethodNotAllowedNoDuplicates — asserts no duplicate values in Allow header and that POST is present
• Existing TestMethodNotAllowed still passes (2 distinct methods, GET and HEAD, each appear once)
• go test ./...

Fixes #996