grpc: enforce strict path checking for incoming requests on the server

[easwars]

RELEASE NOTES:

• server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error.

[codecov]

Codecov Report

❌ Patch coverage is 61.53846% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.20%. Comparing base (b6597b3) to head (4d9a3ad).

Files with missing lines	Patch %	Lines
server.go	61.53%	7 Missing and 3 partials ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           v1.80.x    #8987      +/-   ##
===========================================
- Coverage    83.42%   83.20%   -0.22%     
===========================================
  Files          410      410              
  Lines        32572    32586      +14     
===========================================
- Hits         27172    27114      -58     
- Misses        4030     4073      +43     
- Partials      1370     1399      +29     

Files with missing lines	Coverage Δ
internal/envconfig/envconfig.go	100.00% <ø> (ø)
server.go	82.48% <61.53%> (-0.25%)	⬇️

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.