Fix for double content when return is used in error_page handler.

Test case:

   location / {
       error_page 405 /nope;
       return 405;
   }

   location /nope {
       return 200;
   }

This is expected to return 405 with empty body, but in 0.8.42+ will return
builtin 405 error page as well (though not counted in Content-Length, thus
breaking protocol).

Fix is to use status provided by rewrite script execution in case
it's less than NGX_HTTP_BAD_REQUEST even if r->error_status set.  This
check is in line with one in ngx_http_script_return_code().

Note that this patch also changes behaviour for "return 302 ..." and
"rewrite ... redirect" used as error handler.  E.g.

    location / {
        error_page 405 /redirect;
        return 405;
    }

    location /redirect {
        rewrite ^ http://example.com/;
    }

will actually return redirect to "http://example.com/" instead of builtin 405
error page with meaningless Location header.  This looks like correct change
and it's in line with what happens on e.g. directory redirects in error
handlers.

src/http/modules/ngx_http_rewrite_module.c

@@ -167,8 +167,8 @@ ngx_http_rewrite_handler(ngx_http_request_t *r)
         code(e);
     }
 
-    if (e->status == NGX_DECLINED) {
-        return NGX_DECLINED;
+    if (e->status < NGX_HTTP_BAD_REQUEST) {
+        return e->status;
     }
 
     if (r->err_status == 0) {