Invalid WebTransport CONNECT returns `Ok(WebTransportSession)` after HTTP 400

Version

h3-webtransport 0.1.2

Platform

Linux desktop 7.1.7 NixOS x86_64 GNU/Linux

Summary

Invalid CONNECT returns a successful session object after sending HTTP 400

Code Sample

let request = http::Request::builder()
    .method(http::Method::POST) // or CONNECT without Protocol::WEB_TRANSPORT
    .uri("https://localhost/not-webtransport")
    .body(())?;

let result = WebTransportSession::accept(request, request_stream, h3_connection).await;

// Actual in 0.1.2: the peer receives HTTP 400, but the server gets Ok(session).
assert!(result.is_ok());

A complete harness needs an h3 request stream and peer settings with WebTransport and datagrams enabled so execution reaches the request validation branch.

Expected Behavior

Invalid input should produce a non-session outcome: an error, Ok(None), or an enum distinguishing accepted and rejected requests. Ok(WebTransportSession) should imply that a successful 2xx CONNECT response was sent.

Actual Behavior

WebTransportSession::accept() validates that the request is CONNECT with the WebTransport protocol extension. When validation fails, it sends an HTTP 400 Bad Request, but then continues constructing and returns Ok(WebTransportSession).

This allows application code to enter a session loop for a request the crate itself rejected on the wire.

Suggested upstream fix

Return immediately after sending the rejection response and expose a typed rejection result. Consolidate request validation ownership so callers do not need to duplicate the crate's private validation logic.

Start at WebTransportSession::accept and trace the request-validation branch reached by an invalid POST or CONNECT request. Build the h3 request-stream harness with WebTransport and datagram settings, then verify that a rejected request cannot produce an Ok(WebTransportSession) result after the HTTP 400 response.