Shared host/method allowlist enforcement for HTTP backends.
Both the mock and the real (Req) backend run this before any I/O, so the
capability guarantee — a node can only reach hosts/methods it declared in
[effects].http — holds identically regardless of backend.
Summary
Functions
Check a method + url against the declared allow hosts and methods.
Returns :ok or {:deny, detail} with a human-readable reason.