Response splitting vulnerability in WEBrick

WEBrick seems to be vulnerable to a [response splitting attack](https://www.owasp.org/index.php/HTTP_Response_Splitting). The reproduction script is very similar to the code shown on the owasp page:

require 'webrick'

class MyServlet < ::WEBrick::HTTPServlet::AbstractServlet
  def service req, res
    res.cookies << WEBrick::Cookie.new('author', req.query['author'])
    res.body = 'hello world'
  end
end

server = ::WEBrick::HTTPServer.new Port: 8080
server.mount "/", MyServlet
trap('INT') { …