Don't send RST_STREAM to idle stream

doc: clarify flow control behaviour for nghttp2_session_send()

The previous wording implied that if send_callback doesn't return
NGHTTP2_ERR_WOULDBLOCK, this function would always send all
submitted requests / data. This is not the case, since flow control can
cause some data to remain queued until WINDOW_UPDATE is received.

Signed-off-by: Asra Ali <asraa@google.com>

Implement max settings option

This reverts commit b7d16101.

nghttpx: Add PROXY protocol version 2

Fix doc

Always call init_forwarded_for to get the default when source address
in PROXY protocol is ignored.  This ensures that forwarded header
field has the same value as x-forwarded-for.

Add CIFuzz

Fix get_x509_serial for long serial numbers

Fix receiving stream data stall

Enable session_create_idle_stream test, fix errors

Previously, if automatic window update is enabled (which is default),
after window size is set to 0 by
nghttp2_session_set_local_window_size, once the receiving window is
exhausted, even after window size is increased by
nghttp2_session_set_local_window_size, no more data cannot be
received.  This is because nghttp2_session_set_local_window_size does
not submit WINDOW_UPDATE.  It is only triggered when new data arrives
but since window is filled up, no more data cannot be received, thus
dead lock happens.

This commit fixes this issue.  nghttp2_session_set_local_window_size
submits WINDOW_UPDATE if necessary.

https://github.com/curl/curl/issues/4939

Bump llhttp to 2.0.4

Add the currently-unused `test_nghttp2_session_create_idle_stream()`
function to the test suite definition.

Modify the test in two places to make it pass:

  * Use stream ID=10 as the priority stream ID to test automatic creation
    of streams for priority specs. The code below checks against stream
    ID=10 so I assume this was a typo in the test.

  * Set the `last_sent_stream_id` instead of the `next_stream_id` to test
    that idle streams cannot be created with smaller numbers than the
    most-recently-seen stream ID. Looking at the validation path in
    `session_detect_idle_stream()`, I think this was another test typo.