[GO-2024-2687] HTTP/2 CONTINUATION flood in net/http

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header
data by sending an excessive number of CONTINUATION frames.

Maintaining HPACK state requires parsing and processing all HEADERS and
CONTINUATION frames on a connection. When a request's headers exceed
MaxHeaderBytes, no memory is allocated to store the excess headers, but they are
still parsed.

This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts
of header data, all associated with a request which is going to be rejected.
These headers can include Huffman-encoded data which is significantly more
expensive for the receiver to decode than for an attacker to send.

The fix sets a limit on the amount of excess header frames we will process
before closing a connection.