net.http: reject malformed Content-Length in H2Conn

A non-numeric Content-Length value (e.g. '12junk') caused all_digits()
to return false on the combined condition, silently leaving
has_content_length false and skipping the body-length completeness
check. The response was then returned successfully despite the invalid
header.

Split the condition so a present-but-non-numeric value returns a stream
error ('h2: malformed Content-Length: <value>') instead of being
silently ignored. RFC 9113 §8.2.1 requires malformed field values to be
rejected.

Co-Authored-By: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/h2_conn.v

@@ -228,9 +228,13 @@ fn (mut c H2Conn) read_response(stream_id u32, req H2ClientRequest) !H2ClientRes
 						// Only update body_expected on the first (non-1xx) HEADERS
 						// frame. A content-length field in a trailer must not
 						// overwrite the value used for the completeness check below.
-						if !got_headers && f.name == 'content-length' && all_digits(f.value) {
-							body_expected = f.value.u64()
-							has_content_length = true
+						if !got_headers && f.name == 'content-length' {
+							if all_digits(f.value) {
+								body_expected = f.value.u64()
+								has_content_length = true
+							} else {
+								return error('h2: malformed Content-Length: ${f.value}')
+							}
 						}
 					}
 				}