fix(api/v2): always bind the internal-dispatch marker

The marker was only ever set, never cleared, so a dispatch with no parent echo
context would inherit an outer dispatch's route instead of failing closed as its
comment claimed. Write the key unconditionally and let shouldSkipRouteCheck's
non-empty guard reject the unbound case.

Address pr-swarm finding: security

Author: kolaente

pkg/modules/humabridge/humabridge.go

@@ -70,11 +70,13 @@ type groupPrefixAdapter struct {
 
 func (a *groupPrefixAdapter) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	// No parent route to bind the marker to means the dispatch gets authorised
-	// like any client request.
+	route := ""
 	if c, ok := ctx.Value(EchoContextKey).(*echo.Context); ok {
-		ctx = context.WithValue(ctx, internalDispatchKey{}, c.Path())
+		route = c.Path()
 	}
+	// Always write the key: an inherited marker from an outer dispatch would
+	// otherwise describe a route this one isn't on.
+	ctx = context.WithValue(ctx, internalDispatchKey{}, route)
 	r = r.Clone(ctx)
 	if a.groupPrefix != "" && !strings.HasPrefix(r.URL.Path, a.groupPrefix) {
 		r.URL.Path = a.groupPrefix + r.URL.Path