prevent header injection in http methods (bpo-39603)

Port the patch from Python 3.6 (f02de961b9) to our stdlib: reject
control chars in http method in http.client.putrequest to prevent http
header injection.

--HG--
branch : release-pypy3.6-v7.x
1 job for topic/release-pypy3.6-v7.x/36-secfix in 6 minutes and 28 seconds