test(server): cover unimplemented methods in the refused-request check

HEAD and OPTIONS are refused by `_handle_unsupported_request`, which runs
downstream of session registration just like the validation failures already
covered here, and echoes the session id back in the same way. Both therefore
leave a live session behind on an unpatched tree.

They need no production change: the discard keys off the establishing
response status, so 405 is already subsumed by `>= 400`. Pinning them stops a
later refactor from narrowing that to an enumerated list of validation
failures and silently reopening the method-independent half of the leak.

Reported by @pete-builds on #3228, reproduced against released 1.29.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sainikhiljuluri

tests/server/test_streamable_http_manager.py

@@ -187,6 +187,8 @@ async def send(message: Message) -> None:
         ),
         pytest.param("GET", [(b"accept", b"text/event-stream")], b"", 400, id="get-without-session"),
         pytest.param("DELETE", [], b"", 400, id="delete-without-session"),
+        pytest.param("HEAD", [], b"", 405, id="head-is-not-implemented"),
+        pytest.param("OPTIONS", [], b"", 405, id="options-is-not-implemented"),
     ],
 )
 async def test_refused_request_leaves_no_session_behind(
@@ -199,6 +201,11 @@ async def test_refused_request_leaves_no_session_behind(
     refusal has to undo it. Otherwise a rejected request grows `_server_instances` forever and hands
     the caller a session id that later requests can still use.
 
+    The property is method-independent: a method the transport does not implement at all is refused
+    by `_handle_unsupported_request`, which also runs downstream of registration and also echoes the
+    session id back. That is why the discard keys off the response status rather than an enumerated
+    list of validation failures.
+
     This is the same property the suite already asserts by name for the 413 path in
     `test_oversized_content_length_is_rejected_before_body_read_or_session_creation`.
     """