[3.10] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (#145600)

[3.10] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (#145600) #42760