Parse HTTP/1.1 responses, not just requests

[MDA2AV]

Why

Glyph11 hardens one direction. A client writes requests and reads responses, so today none of the entry points apply to it - BinaryRequest carries Method, Path and QueryParameters, DetectBodyFraming is typed to it, and even HttpParseException carries "the status code to return", which is server framing.

This adds the other half. The header block is where the value is and it carries over untouched: bare LF, obs-fold, whitespace before the colon, token and field-value validation, Content-Length format and duplicate checks, and the Transfer-Encoding + Content-Length rejection - a desync vector in this direction too, where the remainder of a mis-framed response becomes the head of the next one.

API

var response = new BinaryResponse();
ReadOnlyMemory<byte> buffer = /* ... */;

if (UltraHardenedParser.TryExtractFullResponseHeaderROM(
        ref buffer, response, ParserLimits.Default, out int consumed))
{
    int status = response.Status;                    // 404
    var framing = BodyFramingDetector.DetectResponseBodyFraming(response, "GET"u8);
}

Three decisions worth reviewing

DetectResponseBodyFraming takes the request method, and cannot not take it. A HEAD response carries the Content-Length its body would have had, and no body. Framing it from its own headers reads the next response as this one's content. Same for a 2xx to CONNECT, which is a tunnel. This is the one place the response API cannot mirror the request API, so it is the part most worth a second opinion.

HTTP/1.1 200\r\n is accepted. RFC 9112 section 4 asks for the SP even when the reason phrase is empty. Origins send it without. There is no parsing ambiguity, so rejecting it buys nothing and costs interop.

BodyFraming.UntilClose is new. A response with no framing header runs to end of connection (section 6.3) - the only framing HTTP/1.0 origins ever had. A request can never be framed this way, so the enum gained a member rather than reinterpreting None.

Also: ParserLimits gains MaxReasonPhraseLength (default 512).

Note on the multi-segment path

TryExtractFullResponseHeaderValidated linearizes via ToArray(), mirroring the request entry point. That is a fair default for a server, where the request header usually arrives in one segment - but a client reading off a socket spans segments as the common case, so the XML doc points those callers at the ROM overload with their own contiguous buffer. Changing the library's linearization strategy felt like a separate PR.

Tests

37 new tests covering the status line, the shared header rules, the Host rule not applying, and every framing branch including the HEAD trap. Full suite: 403 passing, 0 failing.