Exclude CONNECT from allowed HTTP methods

Updated initAllowedHttpMethods in WebContentGenerator and
RequestMappingInfoHandlerMapping to explicitly exclude the CONNECT
method.

Author: v-perfilev

spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/RequestMappingInfoHandlerMapping.java

@@ -517,7 +517,7 @@ private static Set<HttpMethod> initAllowedHttpMethods(Set<String> declaredMethod
 			Set<HttpMethod> result = CollectionUtils.newLinkedHashSet(declaredMethods.size());
 			if (declaredMethods.isEmpty()) {
 				for (HttpMethod method : HttpMethod.values()) {
-					if (method != HttpMethod.TRACE) {
+					if (method != HttpMethod.TRACE && method != HttpMethod.CONNECT) {
 						result.add(method);
 					}
 				}

spring-webmvc/src/main/java/org/springframework/web/servlet/support/WebContentGenerator.java

@@ -146,7 +146,7 @@ private void initAllowHeader() {
 		if (this.supportedMethods == null) {
 			allowedMethods = new ArrayList<>(HttpMethod.values().length - 1);
 			for (HttpMethod method : HttpMethod.values()) {
-				if (method != HttpMethod.TRACE) {
+				if (method != HttpMethod.TRACE && method != HttpMethod.CONNECT) {
 					allowedMethods.add(method.name());
 				}
 			}