Fix CVE-2020-26116:

https://cve.circl.lu/cve/CVE-2020-26116
https://bugs.python.org/issue39603

Taken from upstream (sans test and NEWS update):
https://github.com/python/cpython/commit/668d321476d974c4f51476b33aaca870272523bf

diff --git a/Lib/http/client.py b/Lib/http/client.py
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -147,6 +147,10 @@
 #  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
 # We are more lenient for assumed real world compatibility purposes.
 
+# These characters are not allowed within HTTP method names
+# to prevent http header injection.
+_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
+
 # We always set the Content-Length header for these methods because some
 # servers will otherwise respond with a 411
 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
@@ -1087,6 +1091,8 @@ def putrequest(self, method, url, skip_host=False,
         else:
             raise CannotSendRequest(self.__state)
 
+        self._validate_method(method)
+
         # Save the method for use later in the response phase
         self._method = method
 
@@ -1177,6 +1183,15 @@ def _encode_request(self, request):
         # ASCII also helps prevent CVE-2019-9740.
         return request.encode('ascii')
 
+    def _validate_method(self, method):
+        """Validate a method name for putrequest."""
+        # prevent http header injection
+        match = _contains_disallowed_method_pchar_re.search(method)
+        if match:
+            raise ValueError(
+                    f"method can't contain control characters. {method!r} "
+                    f"(found at least {match.group()!r})")
+
     def _validate_path(self, url):
         """Validate a url for putrequest."""
         # Prevent CVE-2019-9740.
value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=3f14b1b4f70b111c39599cb7d80e698e4622740c'>root</a>/<a href='/guix/log/gnu?id=3f14b1b4f70b111c39599cb7d80e698e4622740c'>gnu</a>/<a href='/guix/log/gnu/packages?id=3f14b1b4f70b111c39599cb7d80e698e4622740c'>packages</a>/<a href='/guix/log/gnu/packages/printers.scm?id=3f14b1b4f70b111c39599cb7d80e698e4622740c'>printers.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/printers.scm?id=3f14b1b4f70b111c39599cb7d80e698e4622740c&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2022-07-31 21:55:43 -0400'>2022-07-31</span></td><td><a href='/guix/commit/gnu/packages/printers.scm?id=1ef04fb2288dade3ad2883026ae286a68ef13a1e'>gnu: qtsvg: Rename variable to qtsvg-5.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2021-06-14 00:24:42 -0400'>2021-06-14</span></td><td><a href='/guix/commit/gnu/packages/printers.scm?id=ea0a51071e68c37a4c9c25421cf03bc2f442c67b'>gnu: Rename qtbase to qtbase-5.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>