Improve validation and hardening of user-supplied data

[tomtaylor]

Harden multipart encoding against malicious filenames, form fields, headers and boundaries. An attacker could use these to craft inject headers or content-disposition directives. This is a similar issue to GHSA-px9f-whj3-246m.

• Multipart.new/1 now raises ArgumentError for boundaries outside the RFC 2046 charset
• Serializing a part whose headers contain CR/LF now raises ArgumentError
• These affect only malformed/malicious input; all existing fixture tests pass unchanged