zstored/zstoredhttp/storage: ensure PUT can only be done for volumes, not user bucket