rgw: reject control characters in response-header actions

rgw: reject control characters in response-header actions

S3 GetObject permits overriding response header values, but those inputs
need to be validated to insure only characters that are valid in an HTTP
header value are present.

Credit: Initial vulnerability discovery by William Bowling (@wcbowling)
Credit: Further vulnerability discovery by Robin H. Johnson <rjohnson@digitalocean.com>
Signed-off-by: Robin H. Johnson <rjohnson@digitalocean.com>
Origin: upstream, https://github.com/ceph/ceph/pull/34504/commits/9ca5b3628245e2878426602bb24f1a4e45edc850

Gbp-Pq: Name CVE-2020-1760-3.patch