Action item for CVE-2019-15226

Following up on the patch for CVE-2019-15226 (#8520), where we added a cached_byte_size_ optional in HeaderMap that is updated with modifications to the HeaderMap, we should take steps to maintain an always-valid internal byte size count:

This would involve eliminating the non-const inline header access functions defined here:

After removing these accessors and changing uses of them to favor other HeaderMap modifiers, we should remove refreshByteSize().

Detail

• Add functionality for modifying inline headers directly.
  • Port over any sets to inline header macros for setReference, setCopy and setInteger
• Add functionality for appending and adding Header values to inline headers.
  • Grepping for insert[A-Z] shows we have 8 references of insert##name left. 4 of these are for using appendToHeader. 2 are const, and 2 are to set GrpcTimeout with Common::toGrpcTimeout.
• Remove non-const inline header entry accessor: ##name() and insert##name()
• Remove non-const HeaderEntry* HeaderMapImpl::get(const LowerCaseString& key).
  • Grepping for get([^)] shows we have 2 non-const refs for get(const LowerCaseString& key):
    source/extensions/filters/http/lua/wrappers.cc:84
source/extensions/filters/http/ext_authz/ext_authz.cc:169
• Fuzz inline header methods
• Remove unnecessary inline header methods for integer types.
• Wrap up misc TODOs in header_map.h, i.e. string -> string_view conversions