BUG/MAJOR: mux-h2: Preserve raw data on aborted frontend tunnels

BUG/MAJOR: mux-h2: Preserve raw data on aborted frontend tunnels

Since the commit 523112b72 ("MEDIUM: mux-h2: Use RAW_DATA blocks to store
tunneled data"), raw data received after a tunnel abort on client side were
not properly handled. These data were added as plain HTTP data, triggering a
BUG_ON() because it is invalid by definition. Instead they must be handled
as true raw data from the HTX point of view.

So now, we properly use RAW_DATA for aborted tunnels on the frontend. The
backend must continue to use regular DATA blocks for the rejection response,
whose payload and trailers remain valid. This matches the existing handling
of trailers and END_STREAM on aborted tunnels.

A regression test was added with early tunnel data left pending, then more
data received after the rejection headers while the response is still
pending.  It reproduces the HTX assertion without this fix.

It is a 3.5-specific issue. No backport is needed.