net/http: invalid headers are normalized, allowing request smuggling [1.13 backport]

[gopherbot]

@FiloSottile requested issue #34540 to be considered for backport to the next 1.13 minor release.

@gopherbot Please open backport issues for this. This was a security problem.

[FiloSottile]

Fixed in 5a6ab1e.