fix http parser: avoid out-of-bounds read in upgrade detection

[netliomax25-code]

1. IsWebSocketUpgradeRequest scans the whole peeked socket buffer for "Upgrade:" and then skips trailing spaces with while (*it == ' ' && it != req.end()), dereferencing the iterator before testing it against the end.
2. When the buffer ends with "Upgrade:" followed by spaces that run to the exact end, the loop walks to req.end() and reads one byte past the buffer; the next line then forms it + kWebsocketUpgradeHeaderValue.size(), a pointer past one-past-the-end. This is reachable before auth: a CONNECT request carries no Upgrade header, so llhttp returns HPE_PAUSED_UPGRADE and Parse() runs this probe over a buffer whose only "Upgrade:" is attacker-appended trailing bytes.

Reordered the loop to check the end iterator first and replaced the pointer walk with a remaining-length comparison, which keeps the existing accept/reject behavior. Verified under AddressSanitizer by feeding the bundled llhttp a CONNECT request ending in "Upgrade:" plus spaces (heap-buffer-overflow read of size 1 before the patch, clean after).