fix(policy): handle unmapped HTTP methods in methodToAction (HEAD, OPTIONS)

[PierreBrisorgueil]

Context

Raised by Copilot review on #3134.

Problem

lib/middlewares/policy.js maps HTTP methods to CASL actions:

const methodToAction = {
  get: 'read', post: 'create', put: 'update', patch: 'update', delete: 'delete',
};

HEAD and OPTIONS are not mapped. When such a request hits policy.isAllowed, action resolves to undefined and is passed to ability.can(undefined, subject), which can produce incorrect authorization decisions or a runtime error depending on CASL's input validation.

Fix

Add explicit mappings for unmapped methods:

const methodToAction = {
  get: 'read', post: 'create', put: 'update', patch: 'update', delete: 'delete',
  head: 'read', options: 'read',
};

Or add a fallback that denies unknown methods by default.