Check `earliest_available_slot` when handling by root/range requests

This was highlighted in a security report

Although it's not a big issue but we should be checking `earliest_available_slot` and cancel requests early.

This also applies for block requests for post-fulu.

Do we wanna close the connection or throw an error?

Trace the request handling for by-root/range requests and the block requests mentioned for post-Fulu, then locate where earliest_available_slot is available. Clarify whether invalid requests should close the connection or return an error, and verify that requests are cancelled early in both paths.

Written by the indexing model from the issue text.