Every kind of response carries the security floor and every mutation checks its origin, proven by two route-walking tests #10918

Every kind of response carries the security floor and every mutation checks its origin, proven by two route-walking tests.

Done looks like:

• [x] a test requests a sample of pages, JSON answers, errors, 404s, 304s and assets and asserts Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each
• [x] a test lists the router's POST/PUT/PATCH/DELETE routes and fails on one with neither an origin check nor a named exemption with its reason
• [x] the tests fail when a header or check is removed (shown in the pull)
• [x] any real gap found is fixed in the same pull

Risks: an exemption list that grows silently; keep it in the test with one reason per line. Suits: mason (security-minded builder)

Files: test/security-floor-every-route.test.ts, test/origin-every-mutation.test.ts, src/http/respond.ts, src/http/origin_gate.ts

Reviewed pull #10931 at its head: ticked a test requests a sample of pages, JSON answers, errors, 404s, 304s and assets and asserts Content-Security-Policy, X-Content-Type-Options and Referrer-Policy on each; a test lists the router's POST/PUT/PATCH/DELETE routes and fails on one with neither an origin check nor a named exemption with its reason; the tests fail when a header or check is removed (shown in the pull); any real gap found is fixed in the same pull.