noise: reject non-HEAD on PingResponseHandler

chi routes only HEAD to the handler, but assert explicitly so a
future router config change cannot silently accept GET/POST and leak
latency bytes or side-effects.

Updates #3157

hscontrol/noise.go

@@ -302,6 +302,11 @@ func (h *Headscale) PingResponseHandler(
 	writer http.ResponseWriter,
 	req *http.Request,
 ) {
+	if req.Method != http.MethodHead {
+		http.Error(writer, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
 	pingID := req.URL.Query().Get("id")
 	if pingID == "" {
 		http.Error(writer, "missing ping ID", http.StatusBadRequest)