CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injection

`CURLOPT_HAPROXY_CLIENT_IP` (introduced in curl 8.2.0) accepts arbitrary strings without any validation or sanitization before injecting them into the HAProxy PROXY protocol v1 header. An attacker who can influence the value passed to this option (e.g., through a web application that proxies …

result = curlx_dyn_addf(&ctx->data_out, "PROXY %s %s %s %i %i\r\n",
                        is_ipv6 ? "TCP6" : "TCP4",
                        client_ip, ipquad.remote_ip,
                        ipquad.local_port, ipquad.remote_port);