http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article