Bound the number of http headers and query parameters per message

[chenBright]

What problem does this PR solve?

Issue Number: resolve

Problem Summary:

CaseIgnoredHasher (headers) and DefaultHasher (query map) are both plain
result = result * 101 + c with no per-process seed, and FlatMap picks a
bucket by masking the low bits of the hash. An attacker only needs the low
log2(nbucket) bits to match, which is brute-forceable offline in seconds and
reusable against every process, since nothing is seeded.

Both maps then degrade to a single chain:

• on_header_value() calls GetOrAddHeader() for every field, so each header
  costs a linear scan of the chain built so far. The cost is on the lookup side
  and is paid unconditionally on the parse hot path.
• URI::ParseQueries() inserts through FlatMap::operator[], which walks the
  chain to dedup. The cost is on the insert side.

Either one turns a single request into O(n^2) work in the server's IO path.
Nothing bounded n: h1 had no field-count limit at all, and h2's
max_header_list_size bounds the decoded bytes of a header block, not the
number of fields in it.

What is changed and the side effects?

Changed:

Tomcat's maxHeaderCount, Envoy's max_request_headers_count, PHP's
max_input_vars, Django's DATA_UPLOAD_MAX_NUMBER_FIELDS and
Tomcat 11's maxParameterCount, all of which were introduced as hashDoS
mitigations.

Therefore, two flags are introduced to bound the number of http headers and
query parameters per message:

• -http_max_header_count (default 100), checked in
  HttpMessage::on_header_value() for h1 and in
  H2StreamContext::ConsumeHeaders() after AppendHeader() for h2.

• -http_max_query_count (default 1000), checked in URI::SetHttpURL() for h1
  and in URI::SetH2Path() for h2. It counts & separators rather than map
  entries: the splitter walks every segment even when the keys repeat, and it is
  that walk the limit is meant to bound.

Setting flag to <= 0 lifts the limit.

Side effects:

• Performance effects:

• Breaking backward compatibility:

---

Check List:

• Please make sure your changes are compilable.
• When providing us with a new feature, it is best to add related tests.
• Please follow Contributor Covenant Code of Conduct.