[9.20] [CVE-2026-3593] sec: usr: Add system test for HTTP/2 SETTINGS frame flood

[9.20] [CVE-2026-3593] sec: usr: Add system test for HTTP/2 SETTINGS frame flood

A use-after-free vulnerability in the DNS-over-HTTPS implementation could cause named to crash when a client sends a flood of HTTP/2 SETTINGS frames while a DoH response is being written. This affects servers with DoH (DNS-over-HTTPS) enabled.

ISC would like to thank Naresh Kandula Parmar (Nottiboy) for reporting this.

For: https://gitlab.isc.org/isc-projects/bind9/-/issues/5755

Backport of https://gitlab.isc.org/isc-private/bind9/-/merge_requests/949

Merge branch '5755-security-heap-user-after-free-http2-settings-9.20' into 'security-bind-9.20'

See merge request isc-private/bind9!992