Add per-role HTTP method scoping to minted tokens

Every token this engine mints is as powerful as the apps it can reach: a
read-only integration can still write to the *arr. arrproxy v0.5.0 accepts
a method scope at mint time, so let a role pin its tokens to it.

- Add an optional role field methods, uppercase-normalized, de-duplicated
  and validated against the known HTTP methods at role write.
- Forward the role's scope as methods on the arrproxy mint request and
  echo it in the creds response alongside apps/subject.
- Omit the field entirely when a role has no scope, so an arrproxy
  predating method scoping sees an unchanged request.
- Cover normalization, rejection, pass-through and the unscoped case.

path_credentials.go

@@ -75,6 +75,7 @@ func (b *arrstackBackend) mintToken(ctx context.Context, req *logical.Request, r
 	minted, err := client.MintToken(ctx, mintTokenRequest{
 		Subject:    subject,
 		Apps:       role.Apps,
+		Methods:    role.Methods,
 		Label:      label,
 		TTLSeconds: int64(ttl.Seconds()),
 	})
@@ -98,6 +99,7 @@ func (b *arrstackBackend) mintToken(ctx context.Context, req *logical.Request, r
 		"token":      minted.Token,
 		"id":         minted.ID,
 		"apps":       role.Apps,
+		"methods":    role.Methods,
 		"subject":    subject,
 		"expires_at": expiresAt.Format(time.RFC3339),
 	}