MINOR: http/hardening: implement hardening "reject-duplicate-host-header"

MINOR: http/hardening: implement hardening "reject-duplicate-host-header"

Rejects requests containing more than one "Host" header field, even if
valid and identical. This is recommended on untrusted listeners. Note that
even if not rejected, duplicate host header fields are folded into a
single one. This was done for h1/h2/h3 which all had the explicit
check to perform deduplication.

In h2 and h3 we also had to make sure not to count host+authority as a
duplicate, so that requires a host counter as a local var, but that's
cheap.

Note that h3 currently doesn't check that duplicate headers are strictly
equal, only the first one is kept.