fix: reject uppercase HTTP/2 field names and values with surrounding whitespace

[pjfanning]

Motivation

RFC 9113 §8.2.1 says an HTTP/2 message is malformed if a field name contains an uppercase character, or if a field value starts or ends with SP or HTAB. Pekko HTTP accepted both. Regular fields are handed to the HTTP/1.1 header-line parser, which matches names case-insensitively and trims the value, so the message was silently normalised instead of rejected. Other HTTP/2 implementations reject these (nghttp2 rejects both; netty rejects uppercase names), so two hops can disagree about the same field.

On the client, a field rejected during decompression left the response with no headers. The failure was then reported as a missing :status rather than as what was actually wrong.

This is behaviour tightening, which suits a major release. Pekko HTTP's own client and server always render lowercase names and never pad values, so traffic between them is unaffected.

Modification

• HeaderDecompression rejects an uppercase field name and a value with leading or trailing SP/HTAB, next to the existing NUL/CR/LF check. Internal whitespace and empty values are still accepted. This stage also decodes responses on the client, so its messages drop the "Malformed request:" prefix.
• ResponseParsing reports a header error from decompression as Malformed response: <reason>.
• Tests:
  • In RequestParsingSpec, lowercase the incidental uppercase names (Foo, Connection, TE) in tests of other rules. Let the :authority/:path tests that pass whitespace-only or whitespace-terminated values also accept the new field-check message; those values are still rejected.
  • New RequestParsingSpec cases: uppercase names, leading/trailing SP/HTAB in values, and acceptance of internal whitespace and empty values.
  • New client/ResponseParsingSpec: a valid response parses; an uppercase name, surrounding whitespace, and CR/LF each fail with a message naming the problem.

Result

• A request with such a field gets a 400 for its stream.
• A response with one fails with a protocol error that names the field problem.

Tests

• Without the main change: the new uppercase/whitespace rejection tests in RequestParsingSpec and the three rejection tests in ResponseParsingSpec fail
• sbt http2-tests/test: 393 passed
• sbt http-core/mimaReportBinaryIssues: pass
• sbt http-core/scalafmtCheckAll http2-tests/Test/scalafmtCheck: pass

References

None - follow-up to #1341