security(headers): validate response header names/values and Set-Cookie lines against CRLF injection #72

Context

User-provided response headers and cookies are forwarded into response header tuples without explicit framework-level CR/LF sanitization. Depending on downstream server validation, this can expose header injection/splitting risk.

Affected areas

• src/dispatch.rs: mapping structured response headers/cookies
• src/response.rs: emitting header pairs

Goal

Introduce explicit validation/rejection of unsafe header names/values and cookie lines at framework boundary.

Requirements

• Reject header names/values containing \r/\n.
• Reject malformed Set-Cookie lines with control characters.
• Return deterministic error path (preferably 500 with safe message) rather than forwarding unsafe data.

Acceptance criteria

• Sanitization checks exist on all structured response header/cookie paths.
• Add tests for malicious header/cookie payloads.
• Existing normal header behavior unchanged.

Out of scope

• Full RFC-grade cookie parser/serializer redesign.