Core: Validate header names and values to prevent CRLF injection

Environment details

1. Core - HttpHeaders in google-http-client
2. OS type and version: Any
3. Java version: Any (Java 8+)
4. google-http-client version: 2.1.1 and earlier

---

Problem Statement

HttpHeaders does not validate header names or values for carriage return (\r) or line feed (\n) characters. If untrusted input is passed into header names or values, an attacker can inject CRLF sequences leading to HTTP Response Splitting or Header Injection.

---

Steps to reproduce

1. Create a HttpHeaders instance with a header name or value containing \r\n.
2. Serialize headers into a low-level HTTP request using HttpHeaders.serializeHeaders(...).
3. Observe that the injected header line is accepted without error.

---

Proposed Fix

Reject header names or values containing CRLF in HttpHeaders.addHeader():

if (name.contains("\r") || name.contains("\n") || stringValue.contains("\r") || stringValue.contains("\n")) {
throw new IllegalArgumentException("Header name or value contains CRLF characters.");
}

Regression tests (testSerializeHeaders_crlfInjectionInName and testSerializeHeaders_crlfInjectionInValue) are included in the accompanying PR.

Start in HttpHeaders.addHeader() and trace how headers reach HttpHeaders.serializeHeaders(...). Run the named regression tests, testSerializeHeaders_crlfInjectionInName and testSerializeHeaders_crlfInjectionInValue, or add them if they are not present. Done means CRLF-containing names and values are rejected while valid headers still serialize successfully.

Vom Indexierungsmodell aus dem Issue-Text verfasst.