The generic way is to look through the code.
pull_permission_mask of init.c contains a list of valid flags (cited here for the current 2.3 release):
unsigned int flags =
--route-nopull is not set on client-side, the following flags are currently accepted additionally:
flags |= (OPT_P_ROUTE | OPT_P_IPWIN32);
Now we have to match this against the options from options.c.
Each option, that has one of the flags above in its
VERIFY_PERMISSION can theoretically be pushed to the client. of course there could be issues as with comp-lzo.
As an example see the following snippet from options.c:
else if (streq (p, "topology") && p)
options->topology = parse_topology (p, msglevel);
OPT_P_UP is in the list of flags above, "topology" may be pushed to clients.