sec(l7): reject duplicate Content-Length headers to prevent request smuggling (CWE-444)

[latenighthackathon]

Summary

• Both parse_body_length() in rest.rs and try_parse_http_request() in inference.rs silently accepted multiple Content-Length headers, overwriting with the last value
• Per RFC 7230 Section 3.3.3, differing Content-Length values must be rejected to prevent HTTP request smuggling (CWE-444)
• rest.rs: Detect duplicate CL headers with differing values and return Err before forwarding
• inference.rs: Add ParseResult::Invalid variant; detect duplicate CL headers and return Invalid
• proxy.rs: Handle ParseResult::Invalid by sending HTTP 400 and denying the connection

Test plan

• Send a request with a single Content-Length header — verify it passes through normally
• Send a request with two identical Content-Length headers (e.g., Content-Length: 10 twice) — verify it is accepted (idempotent duplicate is OK per RFC)
• Send a request with two differing Content-Length headers (e.g., Content-Length: 0 and Content-Length: 50) — verify it is rejected with HTTP 400
• Existing CL+TE rejection test still passes
• Run cargo test for the crate

Closes #637

[github-actions]

Thank you for your interest in contributing to OpenShell, @latenighthackathon.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}