fix(engine): add default ReadHeaderTimeout to http.Server in Run methods

[RubenPari]

Summary

Engine.Run, RunTLS, and RunListener created an http.Server without ReadHeaderTimeout, leaving applications that use the default Run helper exposed to slowloris-style resource exhaustion.

Changes

• Added a new Engine.ReadHeaderTimeout field (time.Duration), defaulting to 10 seconds.
• The http.Server created by Run, RunTLS, and RunListener now sets ReadHeaderTimeout from this field.
• If ReadHeaderTimeout is zero or negative, the 10-second default is used as a fallback.
• Updated the Run doc comment to document the timeout behavior and recommend a custom http.Server for full control.

Why ReadHeaderTimeout?

ReadHeaderTimeout is the most important timeout for slowloris mitigation — it limits how long the server will wait for the client to send the complete request headers. Unlike ReadTimeout or WriteTimeout, it does not interfere with legitimate slow responses or large uploads.

Compatibility

• No breaking change: existing applications get a safe default automatically.
• Users who need a different value can set engine.ReadHeaderTimeout before calling Run.
• Users who need zero timeout (e.g., behind a reverse proxy that handles timeouts) can create a custom http.Server and use engine.ServeHTTP directly.

Test plan

• TestReadHeaderTimeoutDefault — verifies New() sets the 10s default
• TestReadHeaderTimeoutCustom — verifies a custom value is respected
• TestReadHeaderTimeoutZeroFallsBackToDefault — verifies zero falls back to the default
• go test . — all existing tests pass

Fixes #4760

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.33%. Comparing base (3dc1cd6) to head (543190e).
⚠️ Report is 292 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4800      +/-   ##
==========================================
- Coverage   99.21%   98.33%   -0.89%     
==========================================
  Files          42       48       +6     
  Lines        3182     3180       -2     
==========================================
- Hits         3157     3127      -30     
- Misses         17       43      +26     
- Partials        8       10       +2     

Flag	Coverage Δ
	?
--ldflags="-checklinkname=0" -tags sonic	98.32% <100.00%> (?)
-tags go_json	98.25% <100.00%> (?)
-tags nomsgpack	98.30% <100.00%> (?)
go-1.18	?
go-1.19	?
go-1.20	?
go-1.21	?
go-1.25	98.33% <100.00%> (?)
go-1.26	98.33% <100.00%> (?)
macos-latest	98.33% <100.00%> (-0.89%)	⬇️
ubuntu-latest	98.33% <100.00%> (-0.89%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.