BUG/MINOR: h1: report the right error position on authority/host mismatch

BUG/MINOR: h1: report the right error position on authority/host mismatch

When an absolute-form request target does not match the Host header value,
h1_headers_to_hdr_list() reports the error at two places depending on whether
the message must be blocked or only captured:

	if (h1m->err_pos < -1) {
		state = H1_MSG_LAST_LF;
		ptr = host.ptr; /* Set ptr on the error */
		goto http_msg_invalid;
	}
	if (h1m->err_pos == -1) /* capture the error pointer */
		h1m->err_pos = v.ptr - start + skip; /* >= 0 now */

The strict path correctly points at the Host header value while the tolerant
path uses <v>, which at this point still holds the value of the *last* parsed
header field, whatever it was. So with "option
accept-unsafe-violations-in-http-request" enabled, the offset stored in
h1m->err_pos, later used by h1_capture_bad_message() and reported by "show
errors", designates an unrelated part of the message.

Let's use host.ptr in both paths.

This was introduced by commit 25bcdb1d9 ("BUG/MAJOR: h1: Be stricter on request
target validation during message parsing") in 3.0-dev12, so it should be
backported to 3.0 and above.