The Great Monkey-Patch Safari

We want to track down and document all instances of express and our core deps monkey-patching Node core, specifically it's the HTTP internals like `IncomingMessage` and `ServerResponse` where we do our monkey patching. So far as Im aware at least!

The goal being to collect them in one place, decide how to deal with them, push anything we can to node core or otherwise eliminate them.

This is a stub issue rn, hoping folks can collaborate and report places where we do this so we can track and discuss them. I have an actual write up about these issues, some history, and specifics that I'll dig up and probably edit into this or otherwise link to.

I am aware of specifically `on-headerss` and the `res.writeHead` we realized during https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q

What else?

Our practice of extending the proto of `IncomingMessage` and `ServerResponse` to create our `(req, res)` also falls into this category