REGTESTS: http-messaging: test the reporting of HTTP hardening results
This new test checks fs.hdng.found, fs.hdng.fixed, bs.hdng.found and
bs.hdng.fixed from a log-format, as well as the hdng_rej_name converter.
The same anomalies (underscore in a header name, unregistered header,
CTL in a trailer) are sent:
- through the "trusted" profile on both sides: everything passes, and
only "found" reports them;
- in a request to a "strict" profile which deletes the two headers and
rejects the trailer: the 400 is logged with the three rules in "fixed"
and hdng_rej_name only names the reject. The trailers are sent apart so
that the stream exists when they are rejected;
- in a response from a server using the "strict" profile: same with a 502
on the backend side;
- in an H2 request with only the deleted headers: nothing is named.