DiagnosticsHandler is missing validation when injecting headers

[MihaZupan]

runtime/src/libraries/System.Net.Http/src/System/Net/Http/DiagnosticsHandler.cs

Lines 353 to 364 in 5ebfca2

	private void InjectHeaders(Activity currentActivity, HttpRequestMessage request)
	{
	_propagator.Inject(currentActivity, request, static (carrier, key, value) =>
	{
	if (carrier is HttpRequestMessage request &&
	key is not null &&
	HeaderDescriptor.TryGet(key, out HeaderDescriptor descriptor) &&
	!request.Headers.TryGetHeaderValue(descriptor, out _))
	{
	request.Headers.TryAddWithoutValidation(descriptor, value);
	}
	});

Using TryAddWithoutValidation is unnecessarily risky if we aren't 100% certain of the formats used by the propagator implementation.
We should at least call HttpHeaders.CheckContainsNewLineOrNull(value) first.
We could also throw for invalid names while we're at it instead of silently ignoring those.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.