HTTPDecoder: Preserve maxHeaderFieldSize accounting across header name/value transition

[5H4D0WBY73]

Summary

This PR fixes the accounting of maxHeaderFieldSize across the header name → header value transition.

Previously, finish() was called when transitioning from headerName to headerValue, which reset currentFieldByteLength before the header value was parsed. As a result, maxHeaderFieldSize was enforced independently on the header name and header value instead of on the complete header field, contrary to the documented behavior.

This change introduces a flush() helper that forwards the accumulated bytes without resetting currentFieldByteLength. finish() now delegates to flush() before resetting the counter, and the header name → header value transition uses flush() instead of finish().

As a result, the byte counter is preserved across the transition and maxHeaderFieldSize is enforced on the complete header field (name + value) as documented.

Changes

• Introduce flush() to separate flushing from counter reset.
• Preserve currentFieldByteLength across the header name → header value transition.
• Keep existing reset behavior for completed header fields and other parser states.

This PR implements the fix discussed in GHSA-f4r8-q66f-vf84.