net/http: ReadHeaderTimeout Not Applied During Unencrypted HTTP/2 Preface Check

When a Go HTTP server is configured to accept unencrypted HTTP/2 (h2c), it peeks a few bytes off each new connection to detect the HTTP/2 client preface before deciding how to handle the request. That initial read did not honor the server’s configured ReadHeaderTimeout, so a client that opens a connection and never sends data could hold it open indefinitely. An attacker opening many such connections can exhaust server resources, a slow-connection denial of service.