fix: validate coerced header values for CRLF

[mcollina]

Why

processHeader() rejected objects but not functions (typeof fn === 'function'). Non-string values were coerced with `${val}` and written to the HTTP/1.1 wire without isValidHeaderValue(), so a function with a crafted toString() / Symbol.toPrimitive could inject CRLF sequences into request headers.

This is defense-in-depth / hardening, not a security advisory under our threat model: exploitation requires the application to pass a function as a header value (trusted application input). String CRLF was already rejected.

Changes

• After coercing non-string scalar header values, run isValidHeaderValue()
• Same validation for non-string array elements after coercion
• Regression tests for toString and Symbol.toPrimitive on scalar and array paths
• Confirm numbers/booleans still work

Test plan

• node --test test/header-function-crlf.js test/request-crlf.js test/headers-crlf.js test/invalid-headers.js
• npm run lint

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.47%. Comparing base (f36ea9c) to head (0a2ae08).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5579      +/-   ##
==========================================
- Coverage   93.47%   93.47%   -0.01%     
==========================================
  Files         110      110              
  Lines       37564    37575      +11     
==========================================
+ Hits        35114    35122       +8     
- Misses       2450     2453       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.