Decode the route policy in the debug dump too, and call it MOD

[mgrossmann]

Fixes #155

Follow-up to #146 / #153, on the second surface: http_debug()'s route dump.

What it printed before

http_printf(httpc, "\nCGI Table\n");
…
http_printf(httpc, "   Path=\"%s\" Program=\"%s\" Login=%u Wild=%u\n",
    p->path, p->pgm ? p->pgm : "(none)", p->login, p->wild);

login is the legacy byte at +09; auth, resattr, resclass, resname were not printed at all. Unlike /.dsrv there is no hex dump alongside, so for /zosmf/info the entire answer was Login=0 — and that route carries auth = 1 (HTTP_AUTH_NONE), measured live while verifying #153. httpd does not gate it; its 401 comes from mvsMF's own auth track. The old dump could not express that distinction at all.

What it prints now

Route Table
   (Auth=DEFAULT means the route carried no AUTH= keyword and inherits the global LOGIN policy)
   MOD Path="/zosmf/info" Program="MVSMF" Auth=NONE Wild=0 login=0(legacy)
   MOD Path="/zosmf/*" Program="MVSMF" Auth=DEFAULT Wild=1 login=0(legacy)
   LOC Path="/private/*" Auth=BASIC Res=FACILITY:HTTPD.ADMIN Attr=READ Wild=1 login=0(legacy)

• auth and resattr as text, not numbers — same reasoning as the field table: AUTH=DEFAULT is not "no authentication" and resattr 0 is not "no access". This is a one-line-per-route trace rather than a table, so DEFAULT is explained once in the header instead of on every line.
• Res=/Attr= appear only on routes that carry a RES= gate, so the common case stays short and no NULL is dereferenced.
• MOD / LOC told apart by pgm != NULL. The old dump printed Program="(none)" and left the reader to infer it.
• login keeps its place, marked (legacy) — it is still in the block.

The keyword decision

?debug=cgi → ?debug=mod, no alias, consistent with how target=CGI was settled in #146: there are no consumers, and this output goes inside an HTML comment. Worth knowing: an unrecognised debug option is a silent no-op in http_debug(), so a stale ?debug=cgi produces an empty <!-- --> rather than an error. That was the trade-off in the alternative (keeping cgi as an alias), and it was decided against.

Also renamed: heading CGI Table → Route Table, the help line, and dump_cgi() → dump_route().

Verification

make clean under -Wall -Werror, all six modules link. Compile-only — the rendered output has not been seen, and CI does not execute anything either.

The dump is reached through QUERY_DEBUG (httppc.c:133) on any request that reaches CSTATE_DONE, so the live check after deploy is:

curl -s "http://…:8080/.dsrv?target=HTTPD&debug=mod" | tail -20

and the route lines should appear in the trailing HTML comment, with /zosmf/info reading Auth=NONE rather than Login=0.