escape crlf and quotes in multipart Content-Disposition headers

[alhudz]

Repro: send a multipart request whose FormData.fileName (or a File name / field name) contains " or a CRLF, e.g. evil"\r\nX-Injected: 1.
Cause: AbstractWriter.writeFileMetadata and SingleParameterWriter append the field name and file name straight into the quoted Content-Disposition parameters, so the value can close the quote and start a new header line or part.
Fix: percent-encode \r, \n and " in those parameters inside the writer, matching the WHATWG multipart/form-data encoding rules. Added AbstractWriterTest covering an injected file name and field name.

[yvasyliev]

This needs to be backported to #3414

[alhudz]

Backported to 14.x in #3418 - same escaping on AbstractPartEncoder.createHeaders, with a regression test.

[velo]

This covers the non-streaming multipart writer path well: parameter names and filenames are escaped before they reach Content-Disposition, with regression tests for the injection cases. Checks are green and the change is compatible.