Istio AuthorizationPolicy Bypass: HTTP/2 Method-Case Bug

Istio AuthorizationPolicy had a case-sensitive :method bug — HTTP/2 requests could bypass method rules. How it worked, and how to patch it.