keel serve: an HTTP/0.9 request line raises AttributeError in _declared_body_length #989

Found by the PR #987 round-2 review. This predates #987 and is not in its diff.

A request line with no HTTP version (HTTP/0.9 form, e.g. GET /api/config) reaches do_GET with self.headers still a plain dict, because the stdlib parses no header block for 0.9. _admitted refuses it on the Host check. _refuse then calls _drain_request_body → _declared_body_length, which reads self.headers.defects and raises AttributeError: 'dict' object has no attribute 'defects'. The connection drops with no response, and a traceback (with absolute source paths) goes to the stderr that log_message is overridden to keep quiet.

Impact: no security impact found. Any unauthenticated client can write noise to stderr, and the 0.9 client gets a reset instead of a refusal.

Fix sketch: refuse HTTP/0.9 outright (override parse_request or check self.request_version at the top of do_GET), or have _declared_body_length treat a headers object without defects/get_payload as untrusted framing and close. Test: a raw GET /api/config\r\n gets a stated answer or a clean close, and nothing reaches stderr.