Add HTTPReadHeaderTimeout (10s) and HTTPIdleTimeout (120s) constants and
wire them onto the server. ReadHeaderTimeout bounds the header-read phase
specifically, dropping a slowloris client that dribbles headers; ReadTimeout
alone bounds the whole request but not that phase. IdleTimeout bounds
keep-alive reuse so idle connections cannot accumulate without limit.
Server construction moves into newHTTPServer so the timeout configuration
is assertable without binding a listener.
Model: opus-4-8
sneak
78cbb2617e