This fixes a denial of service attack vector where bogusly large chunk
sizes in requests could be used to force restarts of the Varnish
server.

This is Varnish Security Vulnerability VSV00001

For more information visit: https://varnish-cache.org/security/VSV00001

Fixes: #2379

Fixes #2247

Fixes #2304

Remove forgotten debugging VSL.  Renovate a VCL comment.

Fixes #2263

All H2 frame headers gets charged to the sessions "session req"

All H2 frame bodies, except HEADERS, CONTIUATION and DATA also gets
charged to the "session req".

H2 frame bodies of HEADERS, CONTIUATION and DATA gets charged to the request.

will eventually go away.

Fixes #2283

Fixes #2300

Testcase by Simon

WINDOWS UPDATE

the WINDOWS_UPDATE

We expect:

- two initial healthy probes (threshold - 1 = 2 by default)
- eight healthy probes (explicitly checked)
- five failing probes
- two healthy probes

To tolerate up to 500ms before cliexpect runs after the barrier was
raised, we accept up to five additional failed probes.

Ref: bcdf4f12

https://tools.ietf.org/html/rfc7230#section-3.1.2

matches the actual size later on.

Inspired by: #2298

VBE_Poll would not advance to test the next backend on the cooling
list when the backend's n_conn is non-zero. This would create a
spinlock effect, causing delays that could make the master kill the
child because of CLI timeout.

Fixes: #2295

VBE_Delete() and VBE_Poll() are only safe to call from the CLI
handling thread. Add ASSERT_CLI() to make that explicit.

completion function.

Fixes #2285

the argument with a VSL message.

Fixes:	#2299

workspace_client parameter influences H2 traffic.

in order to have less ambiguous error messages.

Refs #2291
Refs #2292

The default separator is now ", " to maintain the "pretty collapsing" of
the headers without risking an extra space with the "; " separator for
cookies.

Refs #2291
Refs #2292

Fixes #2292

Fixes #2291

This done via a new http_CollectHdrSep function, implying a VRT minor
bump.

Refs #2291

Newly loaded VCLs didn't get their go cold timer set even when they
were set to auto, causing them to never go cold automatically.

Fixes: #2270

Fixes #2289

Lck_CondWait() will stopped in the tracks.