HTTP: Protect just-parsed responses from accidental destruction (#1752)

HTTP: Protect just-parsed responses from accidental destruction (#1752)

The lack of HttpReply locking meant that we could not (safely) pass the
freshly created reply object to ACLFilledChecklist because the checklist
destructor would unwittingly destroy the object (by unlocking it). There
is at least one applicable ACL check in handle1xx(), but we got lucky
because that method adds the reply object to ALE, increasing its
reference counter. This change stops relying on such "external" locks.

This change also protects from HttpReply memory leaks when an exception
is thrown between HttpReply creation and a setVirginReply() call.

TODO: Fix all cases where newly created HttpReply objects are remembered
using raw pointers (but may be passed to locking/unlocking code).