add a case of massive HEADERS at startup in the section of DoS Considerations

[shigeki]

An initial value of SETTINGS_MAX_CONCURRENT_STREAMS is no limit and a server can receive massive HEADERS from a malicious client before synchronization of the first SETTINGS.

These requests are legitimate but it is a risk of denial of service attack and need to be described in the security section.

[mnot]

Discussed in Zurich; add a sentence or two to DoS Considerations along these lines.

[martinthomson]

While settings changes are outstanding, there are things that a peer might be able to do that is not provably bad and can therefore be exploited to generate excessive work.