server filename with control characters printed to terminal (`-J`)

Summary: With `-OJ`, curl takes the filename from the server's `Content-Disposition` header. `parse_filename()` in `src/tool_cb_hdr.c` does not remove control characters such as ESC (0x1b). When a warning prints that name, the escape sequences reach the terminal.

   import http.server

   class H(http.server.BaseHTTPRequestHandler):
       def do_GET(self):
           self.send_response(200)
           self.send_header('Content-Disposition',
               'attachment; filename="ok\x1b[2J\x1b[31mPWNED.txt"'
               .encode('latin-1', …