fix(http2): bound peer-controlled streams and headers

[DubaiChewyCookie]

SETTINGS_MAX_CONCURRENT_STREAMS was only consulted when this endpoint created local streams. A peer could ignore the advertised setting and open unbounded streams, allocating stream state, queues, windows, and controllers.

Enforce the configured peer-initiated stream limit locally before creating Http2StreamImpl. Track active peer streams and locally bound reserved PUSH_PROMISE streams as well. Reject excess streams with RST_STREAM REFUSED_STREAM without publishing them through incomingStreams or peerPushes.

Terminate the connection with GOAWAY ENHANCE_YOUR_CALM after the configured number of consecutive violations. Disabled server push is also enforced on receipt instead of relying on peer compliance or SETTINGS acknowledgement.

Inbound HEADERS and CONTINUATION fragments were accumulated without a size or time bound. Each continuation copied the preceding block again, making fragmented field-block assembly quadratic. HPACK also retained the complete decoded header list before application-level limits could run.

Add the following secure defaults per connection:

• 100 peer-initiated streams
• 16 KiB compressed field block
• 8 KiB decoded field section
• 64 CONTINUATION frames per field block
• 10 second absolute field-block timeout
• 8 consecutive stream-limit violations

Start the field-block timer when the initial HEADERS or PUSH_PROMISE frame header is parsed, before its payload is complete. Retain fragments as chunks and combine them once, enforcing compressed-size and CONTINUATION-count limits while the block is received.

Enforce the decoded field-section limit during HPACK processing using name length + value length + 32 bytes per field. Once the limit is crossed, release retained application-visible headers and continue decoding in discard mode so dynamic-table updates remain synchronized.

Reject a completely decoded oversized field section with RST_STREAM ENHANCE_YOUR_CALM and do not publish its headers. Compressed-size, CONTINUATION-count, and timeout violations terminate the connection with GOAWAY ENHANCE_YOUR_CALM because the shared HPACK context cannot safely continue without complete decompression. Invalid HPACK encoding terminates the connection with COMPRESSION_ERROR.

Advertise SETTINGS_MAX_HEADER_LIST_SIZE while enforcing the configured limit locally because the setting is advisory. This also resolves the unbounded buffering TODO introduced by fdaeafb.

Tests cover ACK-independent stream admission, exact N and N+1 limits, active and reserved stream recovery, disabled push, repeated abuse, compressed and decoded size boundaries, many continuations, slow initial payloads, Huffman and indexed amplification, HPACK dynamic-table synchronization, HEADERS, trailers, and PUSH_PROMISE.

RFC 9113 sections 4.3, 5.1.2, 6.5.2, and 10.5:
https://www.rfc-editor.org/rfc/rfc9113.html

CERT/CC VU#421644:
https://kb.cert.org/vuls/id/421644

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.