Fish 9690 filtering incorrect characters from header rfc 9110

[breakponchito]

This is a PR to include new properties on the grizzly implementation to enable Header Name and Header Value validation against invalid characters mentioned on the RFC-9110, here the reference of the reported issue: Glassfish issue and here the reserved CVE CVE-2024-45687

To test this set the dependency version on the payara server: 4.0.2.payara-p2 build and run
deploy the following reproducer:
MinimalTest.zip

after starting the server set the following properties on the Payara configuration. You can do it by console ui, command line or directly on the domain.xml file:

• -Dorg.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110=true
• -Dorg.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110=true

asadmin create-jvm-options --target=server-config "-Dorg.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110\=true"

asadmin create-jvm-options --target=server-config "-Dorg.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110\=true"

after adding the properties you need to restart the server

by default on the grizzly side those properties are set as false

deploy the reproducer and make curl calls

Header Name Validation tests:

• curl -i -v -H $'X-MyHeader\n: hello' http://localhost:8080/MinimalTest/
• curl -i -v -H $'X-MyHeader\r: hello' http://localhost:8080/MinimalTest/
• curl -i -v -H $'X-MyHeader\0: hello' http://localhost:8080/MinimalTest/

the result of any of those test should be error 400:

Header Value Validations tests:

• curl -i -v -H $'X-MyHeader: he\nllo' http://localhost:8080/MinimalTest/
  

• curl -i -v -H $'X-MyHeader: he\rllo' http://localhost:8080/MinimalTest/
  

• curl -i -v -H $'X-MyHeader: he\0llo' http://localhost:8080/MinimalTest/
  

In the case of header validation we can't be very strict on the validation that is why the \n is permitted an is evaluated as a new line on the content for the header value and the \0 is immediately not processed from curl because by default we can't consider that character on the request headers and the \r character can be included as a character on the header values and this will be rejected