A field name or filename containing CRLF (or a `"`) was concatenated
verbatim into the `Content-Disposition` header, letting a caller that
passes attacker-controlled names break out of the header line to inject
additional headers or smuggle extra multipart parts (CWE-93).

Escape `\r`, `\n`, and `"` as `%0D`, `%0A`, and `%22`, matching the
WHATWG HTML multipart/form-data encoding browsers use.

Ref: GHSA-hmw2-7cc7-3qxx

1.x cannot predict V8 randomness on node >= 25, which made
`test-boundary-prediction` fail on node 26; 3.x supports node < 27.