BUG/MEDIUM: h1: reject CONNECT request targets other than "host:port"

BUG/MEDIUM: h1: reject CONNECT request targets other than "host:port"

For CONNECT requests, the H1 parser validates the authority extracted by
http_parse_authority() (with userinfo removed and stopping at the first '/',
'?' or '#') against the Host header and checks it for forbidden
characters. But the request target itself is kept and forwarded as-is.  So
the following targets were accepted with "Host: allowed.com:443":

    CONNECT internal:22@allowed.com:443 HTTP/1.1
    CONNECT allowed.com:443/x HTTP/1.1
    CONNECT allowed.com:443?x HTTP/1.1

and forwarded verbatim to the server (or as the :authority of an H2
request). RFC9112#3.2.3 says the authority-form only contains
"uri-host:port". The next hop (typically a forward proxy) may parse such
invalid targets differently than haproxy (e.g. "internal" port 22), and
connect to a destination that was not checked by the host-based rules.

Now, a CONNECT request is rejected (or the error is captured when unsafe
violations are accepted, like for other authority errors) if the
validated authority does not span the whole request target.

A reg-test was added to verify this.

This was introduced by commit 3f5fbe940 ("BUG/MEDIUM: h1: Improve
authority validation for CONNCET request") in 2.7 which validated the
stripped authority. It should be backported as far as 2.8.