prevent header injection in http methods (bpo-39603)

Port the patch from Python 3.6 (f02de961b9) to our stdlib: reject control chars in http method in http.client.putrequest to prevent http header injection.

Merge request reports