GitLab

We saw in
https://gitlab.com/gitlab-com/gl-infra/production/-/issues/5756 that
restricting newlines in query strings blocks Google Cloud Storage (GCS)
URLs from working since GCS uses a multi-line `Signature` query string.

The original check was introduced to prevent CRLF injection in the Git
protocol (https://gitlab.com/gitlab-org/gitlab/-/issues/8438). Git has
since added protection against newlines in the URL
(https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473),
but they haven't blocked the carriage return (CR) case.

To ensure defense in depth, we continue to block Git requests with CRLF,
but allow multi-line HTTP queries.

Changelog: fixed