test(security): add missing attack vector test cases

[shaneutt]

Attack vectors that still need to be added to the security test suite.

Response-side injection

• Upstream response header injection via CRLF in header values
• Upstream Set-Cookie header injection via CRLF
• Literal control characters (\x01-\x08, \x0e-\x1f) in response headers

Protocol parsing

• Chunked encoding with invalid chunk sizes (non-hex, overflow)
• Mixed chunked + Content-Length on same request (RFC 9112 compliance)
• Request line exceeding max length (expect 414)
• Absolute URI form in request line (GET http://host/path)

URL and path encoding

• Fragment identifier in request URI does not influence routing
• Null byte in query string (%00) handled safely
• Double-encoded path segments don't bypass path matching

TLS

• Weak cipher suite rejection
• ALPN mismatch between client and upstream

Proxy-specific

• SSRF via request to metadata endpoints (169.254.169.254, localhost)
• Proxy loop detection (Via header chain growth)
• Compression bomb (highly compressed body that explodes on decompression)

Connection lifecycle

• Keep-alive poisoning (upstream Connection: keep-alive when proxy expects close)
• HTTP/1.1 request pipelining isolation (responses don't mix)
• Premature backend connection close mid-response