Check for correct handling of missing pseudo-headers, and invalid
characters.
Signed-off-by: Asad Sajjad Ahmed <asadsa@varnish-software.com>

We should apply the same restrictions on the list of allowed characters inside
H/2 pseudo-headers as we do for H/1. This error is translated into the
headers we send to a backend over H/1.

Failure to do so could permit various exploits against a backend not handling
malformed H/1 requests.
Signed-off-by: Asad Sajjad Ahmed <asadsa@varnish-software.com>

This expands the perfect hash lookup table to be able to match any entry
in the list of well-known headers from tbl/http_headers.h.

Previously only the headers that had a non-zero filter flag section was
kept in the fast match table.

Fixes: VSV00010

Limit the fuzzer runs to PRs on `varnishcache`'s repositories. The build
scripts won't work correctly from anywhere else anyways.

The input argument assertions and checks in http_hdr_flags() were
misleading and lacking. With this patch it returns (NULL) on either input
being NULL, and also when called with an empty string instead of
asserting.

In http_EstimateWS(), all headers are passed to the http_isfiltered()
function to calculate how many bytes is needed to serialize the entire
struct http. http_isfiltered() will check the headers for whether they are
going to be filtered out later and if so skip them.

However http_isfiltered() would attempt to treat all elements of struct
http as regular headers with an implicit structure. That does not hold for
the first three pseudo-header entries, which would lead to asserts in
later steps.

This patch skips the filter step for pseudo-headers.

Fixes: #3830

Enable package building on commits

from 7615e559 - sorry

This reverts commit 8f11c925.

And while at it, make it easier to work with distribution names with
less if statements and more case matching.

Better diff with the --ignore-all-space option.

Removed one paragraph which was really confusing and, I guess, wrong:
IIUC, backend references _always_ need to be taken with VRT_Assign_Backend,
because the referencing vmod can make _no_ assumptions about the assigned
backend.

Also I hope to have clarified use of VRT_StaticDirector().

I found the previous wording confusing and hope this is considered an improvement.

We should make clear that lack of onerror="continue" implies abort only if
the feature flag is set.

Refs varnishcache/pkg-varnish-cache#154

Thank you do Dridi for his work on the release documentation.

I have gone through all commits and reused some wording of his
where appropriate.

As before, the changelog should roughly match the commit order (from new
to old).

It was increased in 635f9f20 to avoid
sanitizer suppressions to scroll out of screen the lines we expect to
find, but on some 32bit ARM system it makes the test even less stable.

Refs #3788

Working on the release notes I realized that there was nothing
actionable to prepare for deprecated aliases in future releases.