[feature]: make HTTP read header timeout configurable

[guggero]

Is your feature request related to a problem? Please describe.

One of the new linters has a rule to detect potential problems with intentionally slow clients:
G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)

Describe the solution you'd like

We should add the ReadHeaderTimeout config value everywhere we use a http.Server (non-exhaustive list of examples: REST proxy server, pprof server, let's encrypt cert server) and also make the value globally configurable.

[ErikEk]

I suppose we keep the current behavior as is (which means no timeout) if undefined. I did however notice Nginx have its default read header timeout set to 60s (http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout), while the default setup for Apache has no timeout.

[Chinwendu20]

Please I am a first timer here and I am looking for an issue to get started with. I would like to know if I can take on this

[Chinwendu20]

Hello, I did a quick search for HTTP. Server and these are the files, I found it:

Also, what is your proposal on the value for the ReadHeaderTimeout, 60s?

[ErikEk]

I would leave it unchanged for now.