http2: use strict brotli, forbid large window

Ticket: 9008

Avoids over-allocation from a few bytes

(cherry picked from commit 2b4d7a1f3d)

rust/src/http2/decompression.rs

@@ -90,7 +90,7 @@ pub(super) struct BrotliDecompressor {
 impl BrotliDecompressor {
     pub fn new(cursor: HTTP2cursor) -> BrotliDecompressor {
         BrotliDecompressor {
-            state: BrotliState::new(
+            state: BrotliState::new_strict(
                 HeapAlloc::<u8>::new(0),
                 HeapAlloc::<u32>::new(0),
                 HeapAlloc::<HuffmanCode>::new(HuffmanCode { bits: 0, value: 0 }),