405 Responses Need `Allow` Header

RFC 9110 §15.5.6 requires `Allow` on a 405.

Related, on the 200 path: `configureWebAnnoHeadersFor()` emits `Allow: GET,OPTIONS,HEAD,PUT,PATCH,DELETE,POST`, advertising methods some routes reject with 405.

We are noticing that the 405 response codes occur as expected but their Allow header value can be missing or incorrect. Check all instances of where a 405 is returned and the resulting 'Allow' header. Line up the 'Allow' header value with the actual list of available headers. Do not emit values that are incorrect.