Fix HTTP header value parsing: bounds check and robust trimming

[bsergean]

Summary

• Add bounds check to the space-skipping while loop to prevent UB when the colon is near the end of the line
• Replace the unsigned arithmetic (lineStr.size() - start - 2) with a trailing trim on the extracted value — avoids size_t underflow and correctly handles both \r\n and \n-only line endings
• Fix isspace UB by casting to unsigned char in the lambda
• Remove unused <locale> include

This is an alternative to #564 which identified the same root cause but introduced a redundant 1024-byte cap and used int in the isspace lambda (UB for negative char values).

Test plan

• Existing test suite passes
• Headers with empty values parse correctly
• Headers with no trailing \r (Unix line endings) parse correctly

🤖 Generated with Claude Code