X-HTTP-Method-Override header allows a basic user to perform admin operations

Essentially allows a read-only REST-API user to perform write-operations. Authentication is still required.

This issue applies to MaxScale 25.10 only partially, as 25.10 authorizes against the effective HTTP method and not the "fake" one. 25.10 still uses the wrong method in some checks, e.g. it can be fooled to compare against admin_readonly_hosts when admin_readwrite_hosts would be correct.