MEDIUM: http: enable a few important hardening rules on untrusted connections

MEDIUM: http: enable a few important hardening rules on untrusted connections

For connections coming from non-local IP addresses, we now enable these
hardening rules by default, which should not cause any trouble to
existing applications and which are essentially used to build attacks
when seen in public:

  - reject-content-length-leading-zero
  - reject-content-length-with-te
  - reject-ctl-in-header-trailer
  - reject-header-trailer-folding
  - reject-lowercase-method

This will cause error 400 or 502 depending on the side they are triggered.
In HTTP/1 an error will be captured. We still don't have a capture of what
matched but that's a start.