security/router: suppress X-Powered-By, serve HEAD like GET, accurate Allow header

- Security::headers() now calls header_remove('X-Powered-By') so the exact PHP
  build is not advertised (expose_php=Off remains the belt-and-braces option)
- Router::dispatch() matches HEAD against GET routes; PHP drops the body itself.
  Previously every HEAD probe (uptime monitors, curl -I, crawlers) got a 405
- The 405 response now lists the methods the path actually accepts, including
  HEAD whenever GET is registered
- HttpSmokeTest: 6 new assertions (no X-Powered-By, HEAD 200/404, Allow: POST,
  Allow: GET, HEAD)
- SECURITY_CHECKLIST documents both controls
