[core] thwart h2 request tunnelling
[core] thwart h2 request tunnelling

Existing behavior: strict header parsing, strict host parsing, and
basic url normalization are enabled by default in lighttpd, and
protect against h2 request tunnelling attempts using invalid chars
in headers.

Keeping strict parsing settings enabled is strongly recommended.

If any are explicitly disabled in lighttpd.conf, then this patch takes
steps to thwart h2 request tunnelling.

x-ref:
  "HTTP/2: The Sequel is Always Worse"
  https://portswigger.net/research/http2

gstrauss/lighttpd1.4,lighttpd/lighttpd1.4,lighttpd/lighttpd1.4,gstrauss/lighttpd1.4,lighttpd/lighttpd1.4,lighttpd/lighttpd1.4,gstrauss/lighttpd1.4,lighttpd/lighttpd1.4,lighttpd/lighttpd1.4,gstrauss/lighttpd1.4,gstrauss/lighttpd1.4,gstrauss/lighttpd1.4