fix(http2): bound peer-controlled streams and headers (#1958)

SETTINGS_MAX_CONCURRENT_STREAMS was only consulted when this endpoint created local streams. A peer could ignore the advertised setting and open unbounded streams, allocating stream state, queues, windows, and controllers.

Enforce the configured peer-initiated stream limit locally before creating Http2StreamImpl. Track active peer streams and locally bound reserved PUSH_PROMISE streams as well. Reject excess streams with RST_STREAM REFUSED_STREAM without publishing them through incomingStreams or peerPushes.

Once the peer has acknowledged the advertised stream limit, terminate the connection with GOAWAY ENHANCE_YOUR_CALM after the configured number of consecutive violations. Excess streams received before acknowledgement are still refused but do not count toward the abuse threshold. Disabled server push is also enforced on receipt instead of relying on peer compliance or SETTINGS acknowledgement.

Inbound HEADERS and CONTINUATION fragments were accumulated without a size or time bound. Each continuation copied the preceding block again, making fragmented field-block assembly quadratic. HPACK also retained the complete decoded header list before application-level limits could run.

Add the following secure defaults per connection:

- 100 peer-initiated streams
- 16 KiB compressed field block
- 8 KiB decoded field section
- 16 CONTINUATION frames per field block
- 10 second absolute field-block timeout
- 8 consecutive post-acknowledgement stream-limit violations

Start the field-block timer when the initial HEADERS or PUSH_PROMISE frame header is parsed, before its payload is complete. Retain fragments as chunks and combine them once, enforcing compressed-size and CONTINUATION-count limits while the block is received.

Enforce the decoded field-section limit during HPACK processing using name length + value length + 32 bytes per field. Once the limit is crossed, release retained application-visible headers and continue decoding in discard mode so dynamic-table updates remain synchronized.

Reject a completely decoded oversized field section with RST_STREAM ENHANCE_YOUR_CALM and do not publish its headers. Compressed-size, CONTINUATION-count, and timeout violations terminate the connection with GOAWAY ENHANCE_YOUR_CALM because the shared HPACK context cannot safely continue without complete decompression. Invalid HPACK encoding terminates the connection with COMPRESSION_ERROR.

Advertise SETTINGS_MAX_HEADER_LIST_SIZE while enforcing the configured limit locally because the setting is advisory. This also resolves the unbounded buffering TODO introduced by fdaeafb.

Tests cover ACK-independent stream admission, pre-ACK rejection without abuse counting, post-ACK repeated abuse, exact N and N+1 limits, active and reserved stream recovery, disabled push, compressed and decoded size boundaries, many continuations, slow initial payloads, Huffman and indexed amplification, HPACK dynamic-table synchronization, HEADERS, trailers, and PUSH_PROMISE.

RFC 9113 sections 4.3, 5.1.2, 6.5.2, and 10.5:

https://www.rfc-editor.org/rfc/rfc9113.html

CERT/CC VU#421644:

https://kb.cert.org/vuls/id/421644