[rootsiemen]

Closes #1117

RequestConverter::buildServerHeaders() validated header values for control bytes but not header names, so a control byte in a name (e.g. X-Foo\x01) was forwarded to the Symfony header bag and the $_SERVER key, where it could not be matched by its normal name.

• The header name is now checked with the same HEADER_VALUE_CONTROL_CHARS mask used for values (per FAQ-027, masks stay literal byte sets; no new constant, so the benchmark-mask equality test is unaffected) and rejected with MalformedRequestException (HTTP 400), the same outcome as a control byte in a value.
• METHOD_REGEX now anchors with \z instead of $, so a method with a trailing newline no longer passes validation (the related item noted in the issue).
• Added testControlByteInHeaderNameThrowsMalformedRequestException to tests/RequestConverterTest.php and a CHANGELOG.md entry under [Unreleased] Security.

Note: this environment has no PHP runtime, so the PHPUnit suite and bin/lint.sh could not be run locally here; CI verification is pending.