Fix request method and URI handling in allocation API and node agent

[Copilot]

Two handlers could process requests they should have rejected.

Changes

• Allocation API (pkg/operator/controllers/allocation_api_server.go): the non-POST/PATCH branch reported the error but lacked a return, so disallowed methods fell through and still allocated a game server. Added the return.

if r.Method != http.MethodPost && r.Method != http.MethodPatch {
    badRequestError(w, s.logger, errors.New("invalid method"), "Only POST and PATCH are accepted")
    return // added
}

• Node agent (cmd/nodeagent/nodeagentmanager.go): heartbeatHandler indexed match[1] without checking the regex result, panicking when the request URI didn't match the expected pattern. Added a nil-match guard returning 400.

match := re.FindStringSubmatch(r.RequestURI)
if match == nil {
    badRequest(w, fmt.Errorf("invalid request URI"), "cannot parse game server name")
    return
}
gameServerName := match[1]

Tests

• GET with a valid body is rejected and does not allocate.
• Heartbeat request whose URI doesn't match the pattern returns 400 instead of panicking.