fix(headers): sanitize CRLF and comma injection in HTTP headers

[louzt]

Summary

Strips \r \n and commas from origin/referrer before passing to ffmpeg -headers and mpv --http-header-fields. Prevents CRLF injection (arbitrary HTTP header forging) and comma injection.

What Changed

• src-tauri/src/mpv.rs:215-220 — sanitize origin/referrer in set_headers()
• src-tauri/src/restream.rs:38-49 — sanitize referrer/origin before ffmpeg -headers

Why

Reported as #424 — CRLF injection allows forging arbitrary HTTP headers from the victim's machine.

Compatibility Note

No breaking changes. Legitimate referrers do not contain \r \n or raw commas.

Validation

cargo check passes.

[louzt]

Marking this as ready for review. I clean some inline comments before.

This patch cleanly mitigates the HTTP header injection vulnerabilities reported in #424 by sanitizing the inputs based on the specific delimitation mechanics of the underlying binaries (ffmpeg and mpv).

Core Architectural Reasoning:

1. ffmpeg Sanitization (restream.rs): The -headers flag in ffmpeg expects HTTP newline sequences (\r\n) as header field delimiters. Stripping \r and \n via .replace() guarantees that input strings cannot break the protocol boundaries to forge arbitrary headers, while preserving valid raw commas that may exist in standard tokens or referrers.
2. mpv Sanitization (mpv.rs): Unlike ffmpeg, mpv parses custom fields in --http-header-fields via comma-separation. Therefore, raw commas must be stripped alongside CRLF characters to prevent a malicious metadata string (e.g., origin: host,Authorization: Bearer x) from splitting into an unauthenticated multi-header injection.

No behavior changes are introduced for standard execution flows. All units compile and validation tests pass cleanly.