Harden HTTP header parsing and body framing validation #36243

Motivation

• Ensure HTTP header field-names conform to RFC to protect against malformed or potentially hostile headers.
• Avoid potential ambiguous framing by refusing requests containing both Transfer-Encoding and Content-Length.

Implementation Details

• Header field-names token character whitelist and validation using find_first_not_of with an error of "Invalid HTTP header field-name" thrown upon failure.
• Check in HTTPRequest::LoadBody throwing "Message contains both Transfer-Encoding and Content-Length headers" when both headers are found.

Tests

• Tests for invalid header token characters added to src/test/httpserver_tests.cpp.
• Tests for rejecting requests containing Transfer-Encoding: chunked and Content-Length added to src/test/httpserver_tests.cpp.

Testing

• HTTP server tests from src/test/httpserver_tests.cpp including the new ones for header tokens validation and ambiguous framing were run successfully.
• The old header parser and request body tests were run successfully along with the new tests.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36243.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->