curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)

Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...