http-proxy: verify CONNECT response headers

[alhudz]

The HTTP/1 proxy CONNECT response is read a line at a time in single_header() (lib/cf-h1-proxy.c) and each line is handed to the application as a header (CLIENTWRITE_HEADER | CLIENTWRITE_CONNECT) without passing through Curl_verify_header(). Regular response headers and chunked trailers both go through that helper, which rejects an embedded nul byte and a stray carriage return. So a malicious or MITM proxy can place a nul byte in a CONNECT response header and have it delivered to CURLOPT_HEADERFUNCTION with the nul still in it, the same confusion the helper already guards against for normal headers.

The fix calls Curl_verify_header() on each CONNECT line before it is delivered, bringing this path in line with the regular header path. The check belongs here because this is the only HTTP/1 reader that emits proxy response headers to the client; it also covers the CONNECT-UDP path, as both go through single_header(), while the HTTP/2 proxy path is already validated by nghttp2. test2107 drives a CONNECT reply carrying a nul byte in a header and expects CURLE_WEIRD_SERVER_REPLY (it returns 0 without the patch).

[bagder]

Thanks!