GHSA-w7hm-hmxv-pvhf HPACK decoder panics on invalid input

• crates.io hpack: <= 0.3.0 (no fix yet)

Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error. Example code that triggers this vulnerability looks like this: ```rust use hpack::Decoder; pub fn main() { let input = &[0x3f]; let mut decoder = Decoder::new(); let _ = decoder.decode(input); } ``` hpack is unmaintained. A crate with the panics fixed has been published as hpack-patched. Also consider using fluke-hpack or httlib-huffman as an alternative.