lib: fix response header component sanitization

[quart27219]

Fixes #2469.

It fixes response header component sanitization by stripping \r, \n, and \0 in HttpResponseImpl::addHeader().

This prevents response header injection / splitting when untrusted input is used in response headers.

[an-tao]

@quart27219 Thanks so much for your patch, but this PR adds a mandatory check in the hotspot path, which actually increases the program overhead. I think this should be something that application developers need to pay attention to. They should know which addHeader calls are risky and should add such checks. @marty1885 @rbugajewski

[rbugajewski]

@an-tao Yes, I agree. In this case, it would be worthwhile to mention the risks in the corresponding documentation.