Fix duplicate methods in the Allow header after merging MethodRouters - #3836

Motivation

get registers a handler for both GET and HEAD, so a get route's Allow
header value is GET,HEAD. When two MethodRouters are merged, their Allow
header values are joined together. The join did not remove duplicates, so
merging a get route with a separately built head route produced an Allow
header of GET,HEAD,HEAD:

use axum::routing::{get, head, MethodRouter};

// GET (also serves HEAD) merged with an explicit HEAD handler
let router: MethodRouter = get(|| async {}).merge(head(|| async {}));
// a 405/OPTIONS response now carries `Allow: GET,HEAD,HEAD`

This is reachable through Router::merge as well, whenever the merged routers
have a get route on one side and an explicit head route on the other for the
same path. The builder path already guards against this: append_allow_header
skips a method that is already present, which is why get(..).head(..) on a
single router correctly yields GET,HEAD. Only the merge path was missing the
same guard.

Solution

Route the Bytes + Bytes case of AllowHeader::merge through the existing
append_allow_header helper, one method at a time, so the merged value reuses
the same de-duplication the builder already performs. append_allow_header only
copies the bytes of the method it is given, so its parameter is relaxed from
&'static str to &str to accept the method names split out of the other
header value.

Behavior is otherwise unchanged: None/Skip states merge as before, and
merging routers with disjoint methods still concatenates them in order (the
existing allow_header_when_merging test, which expects PUT,PATCH,GET,HEAD,
still passes). A regression test covers merging a get route with a separate
head route and asserts the Allow header is GET,HEAD.