GHSA-46q4-43ph-c6fr: blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values (e.g. X-Forwarded-For, internal-auth headers) that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application.