Previously we would limit the number of multipart parts which were
files, but not other parts. In some cases this could cause parsing of
maliciously crafted inputs to take longer than expected.

[CVE-2023-27530]

* 3-0-sec:
  bump version
  Limit all multipart parts, not just files

# Conflicts:
#	.github/workflows/test-external.yaml

* Split form/query parsing into two steps

First we parse the raw input into a stream of [key, value] pairs, and
only after that do we expand that into the deep params hash.

This allows a user to operate directly on the pair stream if they need
to apply different semantics, without needing to rewind the input, and
without creating a conflict with anything else (like a middleware) that
wants to use Rack's standard GET / POST hash format.

…2052)

# Conflicts:
#	lib/rack/query_parser.rb

Split headers on commas, then strip the strings in order to avoid ReDoS
issues.

[CVE-2023-27539]