Tighten the HTTP/2 and HTTP/3 `:path` guard to the printable-ASCII bound

So non-ASCII (including the U+0080 - U+00FF window) is rejected before any byte truncation - matching HTTP/1.1's `GetAsciiString` behavior. The #67109 was a good direction, but needs to be tightened even more.

Something like (`Http2Stream.cs:444` and `Http3Stream.cs:1222`):
```csharp
var ch = pathSegment[i];
// URI path must be printable ASCII (matches HTTP/1.1 GetAsciiString + RFC 3986/3987).
if (ch < 0x20 || ch > 0x7E)
{
ResetAndAbort(...);
return false;
}
pathBuffer[i] = (byte)ch;
```

Add regression tests covering the U+0080 - U+00FF window (e.g., U+00A9, U+00C3, U+00E9) plus a percent-escape, asserting PROTOCOL_ERROR, so the coverage gap left by the U+0161-only tests is closed.