Bug 3478: pt1: Host verify catching dynamic CDN hosted sites

Bug 3478: pt1: Host verify catching dynamic CDN hosted sites

This add a bit more leniency to the Host: header validation without
re-opening Squid to the cache poisoning risks involved.Resolving most
issues with websites using geo-based DNS results and/or short DNS TTL for
load balancing.

It alters host_verify_strict directive to allow requests which fail Host:
validation to continue through processing. The default remains OFF.

* blocks caching on the response to protect all other network clients
  against one compromised client spreading infections.

* forces the original (untrusted) destination IP to be used instead of
  any alternative Squid might find. Preventing Squid or peer DNS lookup
  being the point of vulnerability for the same-origin bypass. For any
  client to be vulnerable it must be vulnerable inside the browser agent
  where the original TCP connection is established.

Also add a new error template ERR_CONFLICT_HOST to replace the confusing
"invalid request" message with a clear explanation of the problem and
some client workarounds.

FUTURE WORK:
* adapt processing to allow these requests to safely be passed to peers.
* adapt caching to permit safe sharing between clients making identical
  requests to same sources.