RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

libcurl's RTSP code interpolates the values of `CURLOPT_RTSP_STREAM_URI`, `CURLOPT_RTSP_TRANSPORT`, and `CURLOPT_RTSP_SESSION_ID` directly into the RTSP request text with no check for embedded CR/LF, so a value containing `\r\n` splits one intended RTSP operation into multiple independent RTSP …

curlx_dyn_addf(&req_buffer,
               "%s %s RTSP/1.0\r\n"     /* Request Stream-URI RTSP/1.0 */
               "CSeq: %u\r\n",
               block.request, block.stream_uri, rtsp->CSeq_sent);
...
curlx_dyn_addf(&req_buffer, "Session: %s\r\n", block.session_id);