Resolve a middleware route by host and path, not host alone

[Shine-neko]

Sozu routes on host and path, then forwards to the middleware server, which resolved the route by hostname alone:

self.routes.insert(hostname.clone(), Arc::clone(&route));   // one entry per hostname
self.routes.get(hostname).cloned()                          // path never consulted

Two entrypoints on one hostname therefore collapsed into whichever was stored last — decided by cluster-id order, so renaming a service silently rerouted traffic:

api: app.example.com /api  rateLimit=10
web: app.example.com /     compress

GET /api/users was matched by Sozu against the /api frontend, handed over, and then served from web's backends with web's middleware stack. The rate limit never ran. An ipAllowList or forwardAuth on the losing route was dropped the same way, silently — which makes this a security matter and not only a routing one.

The table now keeps every route a hostname carries with the path it was declared with, and resolution picks the longest matching prefix, a pathless route acting as the catch-all. Prefixes match on segment boundaries, so /api covers /api/users but not /apifoo. Nothing matching answers 404 rather than picking a route at random.

The tests fail against host-only resolution, showing /api/users landing on the / route.

Third of the findings from a full audit, after #140 and #141.