[3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600)

[3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) #109413