Fix prod-mode asserts, middleware exception routing, redirect GET guard

[dereuromark]

Three independent, low-blast-radius bug fixes for the 3.x line.

1. AuthorizationService — replace assert() with explicit throws

The three assert(...) calls in performCheck(), getCanHandler() and getScopeHandler() are compiled out when PHP runs with zend.assertions=-1, which is the standard production setting. Under that configuration:

• A missing policy method silently falls through to the [$policy, $method](...) invocation and produces a generic Error: Call to undefined method ... instead of the documented MissingMethodException.
• A policy method returning an unexpected type (not bool and not ResultInterface) is not caught and produces a downstream type error in can() / canResult().

Existing tests covered the dev-mode behavior via expectException(MissingMethodException::class); the if/throw rewrite makes the same exceptions fire in production as well. Behavior in dev/test is unchanged.

2. RequestAuthorizationMiddleware — route policy exceptions through the configured handler (refs #150)

The $service->canResult(...) call sat outside the try/catch block, so any Authorization\Exception\Exception thrown from inside a RequestPolicy (a MissingMethodException, a custom MissingIdentityException raised by canAccess(), or any other policy-level failure) bypassed the configured unauthorizedHandler and bubbled out of the middleware unhandled. This is the exact issue surfaced in #150 (last comment by matteorebeschi explicitly identifies the asymmetry with AuthorizationMiddleware, which does wrap its check in a try block).

Moving canResult(...) inside the existing try block restores the symmetry. A regression test using the Suppress handler confirms a MissingMethodException is now routed through the handler instead of escaping.

3. CakeRedirectHandler — honor the GET-only guard

The parent RedirectHandler::getUrl() guards the redirect query-param appendage with && $request->getMethod() === 'GET', so POST/PUT/DELETE/PATCH unauthorized responses do not receive a useless ?redirect= payload. The Cake-flavored override at src/Middleware/UnauthorizedHandler/CakeRedirectHandler.php dropped that guard and appended the query param for every method.

Added the missing guard and a data-provider test mirroring RedirectHandlerTest::testHandleRedirectionIgnoreNonIdempotentMethods across the standard non-GET methods.

Verification

• composer test — 147 tests, 302 assertions (was 140 / 289). 7 new assertions across 7 new tests.
• composer stan — clean.
• composer cs-check — clean.