[2.4.x] Merge r1935191, r1935192, r1935193, r1935926, r1935935, r1935941, r1936259, r1936260, r1936262, r1936263, r1936264, r1937041 from trunk

[notroj]

mod_substitute: fix heap over-read in set_pattern() delimiter scanning

* modules/filters/mod_substitute.c (set_pattern): Guard the
  pre-incrementing delimiter scan loops with a NUL check, preventing
  a read past the end of the allocation when the from or to field has
  no closing delimiter.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mod_substitute: reject overflow values in SubstituteMaxLineLength

* modules/filters/mod_substitute.c (set_max_line_length): Check that
  the parsed value does not exceed APR_INT64_MAX / multiplier before
  applying the K/M/G suffix, to avoid signed integer overflow UB.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mod_ssl: fix set_challenge_creds() to return rv on failure

* modules/ssl/ssl_engine_kernel.c (set_challenge_creds): Return rv
  rather than APR_SUCCESS unconditionally, so credential setup
  failures are propagated to the ALPN selection callback.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mod_cern_meta: reject HTTP framing headers in metadata files

* modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500
  error if a framing header is found in a .meta file rather than
  merging it into the response headers.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mod_ssl: fix NULL dereference in OCSP responder URI parsing

* modules/ssl/ssl_engine_ocsp.c (determine_responder_uri): Check
  u->scheme is non-NULL before calling ap_cstr_casecmp(), since
  apr_uri_parse() can succeed with a NULL scheme for scheme-less URIs.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* modules/ssl/ssl_util.c (ssl_asn1_table_set): Add assertion
  for the (likely unreachable) i2d_PrivateKey() failure case.

Submitted by: Sayed Kaif <metsw24 gmail.com>
Github: closes #619


* modules/proxy/balancers/mod_lbmethod_heartbeat.c (hb_parse_int):
  New helper replacing atoi() with safe integer parsing via
  apr_strtoi64, with range validation.
  (readfile_heartbeats): Use hb_parse_int for busy, ready,
  lastseen, and port fields.
  (find_best_hb): Add overflow-safe saturation arithmetic for
  openslots accumulation and the pick loop upper bound.

Submitted by: Sayed Kaif <metsw24 gmail.com>
Github: closes #629


* modules/generators/mod_cgid.c (close_unix_socket): Return errno
  on failure rather than -1.
  (sock_write): Handle short writes.
  (cgid_init): Fix off-by-one in socket path truncation.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: resolves PR#669


* modules/generators/mod_cgid.c (get_req): Fix wrong sizeof in
  allocation of core_request_config, which used sizeof(core_module).
  (cgid_server): Fix stale rv passed to ap_log_error for passed fd
  debug message.
  (include_cmd): Fix double registration of cleanup_script which
  could kill a garbage pid when get_cgi_pid failed.  Check return
  value of send_req.  Change return type to apr_status_t to match
  declaration in cgi_common.h

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR#669


* modules/generators/mod_cgid.c (cgid_req_t): Change env_count to
  unsigned.  Define ENV_COUNT_MAX.
  (get_req): Add upper bounds for uri_len, args_len, and env_count.
  Validate per-variable length in environment reading loop.
  Move validation before use of loglevel.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR#669


* modules/md/md_crypt.c (md_cert_get_ari_cert_id):
  Don't used fixed buffer size for serial number,
  fail if ASN.1->BIGNUM conversion fails.

Github: closes #680


* modules/http/http_filters.c (validate_status_line): Only accept
  space as the status-code separator, not other whitespace.

* server/protocol.c (ap_send_interim_response): Reject control
  characters in the reason phrase of interim responses.

* test/modules/proxy/test_06_interim_resp.py: New test case.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: closes #702

(cherry picked from commit d1e04e6)
(cherry picked from commit 62c9f8f)
(cherry picked from commit b85e024)
(cherry picked from commit 4d8d051)
(cherry picked from commit ac2deae)
(cherry picked from commit 4f87229)
(cherry picked from commit feb1c6e)
(cherry picked from commit 8e210c2)
(cherry picked from commit 489f5ef)
(cherry picked from commit d7ac43a)
(cherry picked from commit 7612f2b)
(cherry picked from commit fbedef2)