.NET: fix: inspect for delemiter value before adding headers

[Vincent Biret (baywet)]

adding headers without validation can lead to corrupted http requests. This fixes the issue by inspecting for end of line characters

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 5cc25ed in the fix/crlf-workflow-cl... branch is 84%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	fix/crlf-workflow-cl... 5cc25ed	+/-
/home/runner/wo...valConverter.cs	—	100%	—
/home/runner/wo...entsProvider.cs	—	99%	—
/home/runner/wo...nticAnalyzer.cs	—	94%	—
/home/runner/wo...tClientAgent.cs	—	91%	—
/home/runner/wo...putConverter.cs	—	90%	—
/home/runner/wo...kflowBuilder.cs	—	90%	—
/home/runner/wo...kflowSession.cs	—	87%	—
/home/runner/wo...SkillsSource.cs	—	86%	—
/home/runner/wo...onExtensions.cs	—	81%	—
/home/runner/wo...ctionVisitor.cs	—	70%	—

[Copilot]

🟢 Approval recommended

The validation covers all unvalidated header paths and includes focused regression tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 3 net-new commit(s): 630ae1922ffa, 617ecacf9667, 5cc25ed5d678
Model: gpt-5.6-sol-fast

Overview

This increment removes attacker-controlled header names from the invalid-name exception, adds direct coverage for CRLF in BodyContentType, and preserves listener cleanup across modern .NET and .NET Framework. Validation still occurs before unchecked header insertion and transport, and the added test verifies the body content-type path cannot reach the message handler. No Critical, High, or Medium defect is supported by the changed lines.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.