net/http: insufficient sanitization of Host header [1.20 backport]

[gopherbot]

@neild requested issue #60374 to be considered for backport to the next 1.20 minor release.

@gopherbot please open backport issues. This is a (fairly minor) security issue.

[gopherbot]

Change https://go.dev/cl/507357 mentions this issue: net/http: validate Host header before sending

[gopherbot]

Change https://go.dev/cl/507905 mentions this issue: http2: validate Host header before sending

[gopherbot]

Change https://go.dev/cl/507906 mentions this issue: http2: validate Host header before sending

[gopherbot]

Closed by merging 312920c to release-branch.go1.20.