Patch security changes

[denihs]

Node released a new security patch. Check it here.

These are the commits we already merged:

• msi: do not create AppData\Roaming\npm nodejs@10042683c8
• policy: handle mainModule.proto bypass nodejs@a6f4e87bc9
• test: allow SIGBUS in signal-handler abort test nodejs@b77000f4d7
• http: disable request smuggling via empty headers (Paolo Insogna) nodejs@e42ff4b018
• deps: update archs files for OpenSSL-1.1.1u+quic nodejs@155d3aac02
• deps: upgrade openssl sources to OpenSSL_1_1_1u nodejs@8d4c8f8ebe
• deps: set CARES_RANDOM_FILE for c-ares nodejs@5df04e893a
• deps: update c-ares to 1.19.1 nodejs@c171cbd124

Not merged:

• nodejs@5a92ea7a3b: Node 14 does not have the X509Certificate API.
  nodejs@1a5c9284eb: The CryptoKey class was only added on v15

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 9 committers have signed the CLA.

✅ denihs
✅ Grubba27
❌ targos
❌ RafaelGSS
❌ richardlau
❌ tniessen
❌ ShogunPanda
❌ indutny
❌ mcollina
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[erikolofsson]

This is missing: nodejs@e42ff4b018
We definitely need the OpenSSL and c-ares updates as they contain security vulnerabilities.

We are already building node ourselves so I gave cherry-picking the fixes from node 16 a try to see what breaks. What I needed to do was:

• Redo the OpenSSL import and arch files update directly from source according to the instructions in the commit message from the last OpenSSL update in node 14. This differs from node 16 where they use a fork of OpenSSL which includes quic.
• Cherry-pick c-ares 1.19.0 update from node 16 before 1.19.1 as that was not included in node 14 previously.
• Manually port the llhttp patch to the 2.1.x branch for llhttp that is used in node 14. Needed to change lenient flags check as that had been refactored in 6.x that is used in node 16. make release and copy the release directory to the deps/llhttp in node. See: Favro/llhttp@2e2886b

You can see the full list of commits I cherry-picked and successfully built here: Malterlib/node@edd64fe...b7ed6ae

We are using BoringSSL instead of OpenSSL, so I didn't try if the OpenSSL build works with the alternate method, but it should be ok.