http2: don't allow invalid characters in headers

[rexagod]

Refs: #29829

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[jasnell]

These checks were left out of the http2 code largely because these characters are significantly less dangerous in http2 than http1 due to the way header encoding works. The invalid characters are also handled significantly better by implementations.

Specifically, in HTTP/1, because header bytes are written out directly to the stream, invalid characters are dangerous because they can introduce security issues that enable vulnerabilities like request/response smuggling/splitting. With HTTP2's binary framing and header encoding, those risks are eliminated and many http/2 implementations have improved checks at the header decoding layer to catch (and ignore) invalid headers when they are encountered.

These checks at the JavaScript layer, then, are not strictly needed the way they are in the HTTP/1 implementation and I'm not convinced we need them.

[BridgeAR]

I am going to close this due to the mentioned comment. If anyone disagrees, please reopen, leave a comment or open a new PR.