Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that [Rack::Sendfile](https://github.com/rack/rack/blob/v2.2.2/lib/rack/sendfile.rb) and the Rails [send_file](https://api.rubyonrails.org/classes/ActionController/DataStreaming.html#method-i-send_file) that handles it have a problem handling custom headers for request.

def variation(env)
  @variation ||
    env['sendfile.type'] ||
    env['HTTP_X_SENDFILE_TYPE']
end

def map_accel_path(env, path)
  if mapping = @mappings.find { |internal, _| internal =~ path }
    path.sub(*mapping)
  elsif mapping = env['HTTP_X_ACCEL_MAPPING'] …