V0.10.35 http method check

[jasnell]

Per #8947, the http.request constructor is not properly checking the validity
of the HTTP method input by the user. The problem allowed HTTP request
headers to be injected via the method option as reported in #8947. This fixes
the problem by introducing a quick check against a the HTTP token rule to
ensure that the method is valid.

[misterdjules]

Thanks for the PR. I'm not sure if this is the best way to fix this issue, but I have a few comments regarding the PR itself though.

• It should target the oldest branch that is affected by the issue, in this case v0.10. You might have to close this PR and reopen a new one to change the target branch.
• The commits should be squashed into one commit.
• The commit message should conform to the guidelines.
• The PR's title should not contain a specific version number.

Hopefully we'll be able to review the code changes themselves soon. Thank you again!

[jasnell]

Yep, another approach is to scan through each char and throw on the first non-token char (or not throw and fallback to the default, which seems bad too).

(I thought I had squashed those commits together... how odd. Will retarget this to v0.10 tomorrow and resubmit.)

[misterdjules]

Another thing I failed to mention previously is that we'd need to have tests for this change.

[jasnell]

Replacing with .. #9017