pg_net doesn't reject headers with \r or \n in them

[imor]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

pg_net doesn't reject headers with \r or \n in them leading to downstream http parsers getting confused about where the headers end and body begins. In one reported instance a header value with a trailing \n prematurely ended the header part because libcurl also appends \r\n at the end of headers (see https://curl.se/libcurl/c/CURLOPT_HTTPHEADER.html)

To Reproduce

Add a header value with \n at the end and see the downstream http parser will see any header after the poisoned header a part of the body. Supabase's edge functions also parse the request like this.

Expected behavior

Request with \r or \n in headers should be rejected when it's being made and should never reach the downstream http server.