Previously, GET requests for a directory URL always returned an HTML directory listing. There was no way to suppress this, unlike `serve webdav` which has supported --disable-dir-list since #4191. This adds the same flag to `serve http`. When set, GET requests for directory URLs return 404 instead of a listing, while file downloads continue to work normally. Based on the approach suggested in #6306. Fixes #4000