fix(server): set ReadHeaderTimeout on HTTP servers (#38878)

Add `ReadHeaderTimeout` which limits how long a client can take to send HTTP headers.

modules/graceful/server_http.go

@@ -8,6 +8,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"time"
 )
 
 func newHTTPServer(network, address, name string, handler http.Handler) (*Server, ServeFunction) {
@@ -17,9 +18,10 @@ func newHTTPServer(network, address, name string, handler http.Handler) (*Server
 	protocols.SetHTTP2(true)            // HTTP/2 can only be used when Gitea is configured to use TLS
 	protocols.SetUnencryptedHTTP2(true) // Allow HTTP/2 without TLS, in case Gitea is behind a reverse proxy
 	httpServer := http.Server{
-		Protocols:   &protocols,
-		Handler:     handler,
-		BaseContext: func(net.Listener) context.Context { return GetManager().HammerContext() },
+		Protocols:         &protocols,
+		Handler:           handler,
+		BaseContext:       func(net.Listener) context.Context { return GetManager().HammerContext() },
+		ReadHeaderTimeout: 10 * time.Second,
 	}
 	server.OnShutdown = func() {
 		httpServer.SetKeepAlivesEnabled(false)