A field name or filename containing CRLF (or a `"`) was concatenated
verbatim into the `Content-Disposition` header, letting a caller that
passes attacker-controlled names break out of the header line to inject
additional headers or smuggle extra multipart parts (CWE-93).

Escape `\r`, `\n`, and `"` as `%0D`, `%0A`, and `%22`, matching the
WHATWG HTML multipart/form-data encoding browsers use.

Ref: GHSA-hmw2-7cc7-3qxx

…, `tape`