Reject invalid characters in response header names and values

[Natalia Bidart]

ResponseHeaders._convert_to_charset() only rejects CR and LF, so other characters that are invalid per ​RFC 9110 section 5.5 are sent as-is:

Field values containing CR, LF, or NUL characters are invalid and dangerous [...] Field values containing other CTL characters are also invalid [...]

Field names must be token characters, which Django doesn't validate at all. For example:

from django.conf import settings; settings.configure()
from django.http import HttpResponse

r = HttpResponse()
r["X-Test"] = "a\x00b"
r["X-Test\x0b"] = "1"
print(r.serialize_headers())

outputs:

b'Content-Type: text/html; charset=utf-8\r\nX-Test: a\x00b\r\nX-Test\x0b: 1'

Django could raise django.http.BadHeaderError for NUL and other C0 controls (except HTAB) and DEL in values, and for non-token characters in names, similar to what #37100 did for reason_phrase. Note that _control_chars_re can't be reused as is.

[NAYAN SHARMA]

I've submitted a patch for this ticket in a GitHub pull request. The changes add validation for invalid characters in HTTP response header names and values, along with tests for the relevant cases.