A field name or filename containing CRLF (or a `"`) was concatenated
verbatim into the `Content-Disposition` header, letting a caller that
passes attacker-controlled names break out of the header line to inject
additional headers or smuggle extra multipart parts (CWE-93).

Escape `\r`, `\n`, and `"` as `%0D`, `%0A`, and `%22`, matching the
WHATWG HTML multipart/form-data encoding browsers use.

Ref: GHSA-hmw2-7cc7-3qxx

…, `tape`

`Buffer.from` is not available before node 4, but this branch supports
node >= 0.12; use `safe-buffer`, matching the other tests.

1.x cannot predict V8 randomness on node >= 25, which made
`test-boundary-prediction` fail on node 26; 3.x supports node < 27.