Sync high-value bug fixes from upstream undici

[ronag]

Summary

Cherry-picks (with adaptation) high-value upstream bug fixes that were still missing from this fork. This PR is the subset that actually applies to the fork's slim feature set (HTTP/1 client + agent + pool, no fetch/h2/cache/socks/websocket).

Security

• parseHeaders prevent __proto__ prototype pollution in response headers (upstream #4923)
• trailers preserve trailers that shadow Object.prototype via defineProperty instead of Object.assign (upstream 90a1609d)
• request use hasSafeIterator to guard against polluted Object.prototype[Symbol.iterator] (upstream #4824)

Correctness

• request accept RFC 7230 comma-separated Connection header tokens (close, keep-alive, upgrade, custom names) — was rejecting valid values (upstream #4775)
• client-h1 validate EOF for chunked h1 responses; surface ResponseContentLengthMismatchError / HTTPParserError instead of silently completing on truncated bodies (upstream #5273)
• client-h1 pre-increment kCounter so maxRequestsPerClient: N enforces exactly N requests per socket (was N+1 due to post-increment) (upstream #5034)
• client-h1 reuse parser WeakRef across setTimeout calls instead of allocating a fresh one each time (upstream #5125)

Also included (from prior local fixes on this branch)

• `globalDispatcher` symbol kept at `.1` (no v2 bump)
• `makeDispatcher` strips `dispatcher`/`agent` out of `opts` before spreading, so they don't reach the instance `dispatch()` guard added in upstream #5007

Skipped after investigation

• fix: preserve pool capacity after removing stale client nodejs/undici#5151 / fix: replace stale pool clients under connection limit nodejs/undici#5145 (pool capacity / stale client replacement) — `kRemoveClient` is defined but never called in this fork
• Fix clientTtl cleanup race in Agent nodejs/undici#4807 (clientTtl cleanup race) — fork's pool-base already has the `destroyed` checks; agent has no per-origin count bookkeeping

Test plan

• `node --test test/prototype-headers.js` — 2/2 pass (new file)
• `node --test test/request.js` — 18/18 pass (5 new Connection-header tests + polluted-iterator test)
• `node --test test/client-timeout.js` — 5/5 pass (new WeakRef test)
• `node --test test/parser-issues.js` — 5/5 pass (new truncated-chunked test)
• `node --test test/close-and-destroy.js` — 11/11 pass (existing maxRequestsPerClient tests now assert per-request connection assignment `[0,0,1,1]`)
• `node --test test/dispatcher.js` — 1/1 pass
• `node --test test/node-test/agent.js` — 24/24 pass

🤖 Generated with Claude Code