panicweb: Set http.Server.ReadHeaderTimeout to 2s

This silences gosec G114 and fixes the slowloris DoS attack.

Author: maruel

cmd/panicweb/main.go

@@ -107,7 +107,11 @@ func main() {
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
 		_, _ = w.Write(rootPage)
 	})
-	go http.Serve(ln, http.DefaultServeMux)
+	srv := &http.Server{
+		Handler:           http.DefaultServeMux,
+		ReadHeaderTimeout: 2 * time.Second,
+	}
+	go srv.Serve(ln)
 
 	// Start many clients.
 	a := ln.Addr()

stack/context_test.go

@@ -2352,7 +2352,7 @@ func identifyPanicwebSignature(t *testing.T, b *Bucket, pwebDir string) panicweb
 				t.Fatal("expected Locked")
 			}
 			// This is a change detector on internal/main.go.
-			want := Stack{Calls: []Call{newCallLocal("main.main", Args{}, pathJoin(pwebDir, "main.go"), 141)}}
+			want := Stack{Calls: []Call{newCallLocal("main.main", Args{}, pathJoin(pwebDir, "main.go"), 145)}}
 			compareStacks(t, &b.Signature.CreatedBy, &want)
 			for i := range b.Signature.Stack.Calls {
 				if strings.HasPrefix(b.Signature.Stack.Calls[i].ImportPath, "github.com/mattn/go-colorable") {