docs: clarify that curl passes on input unfiltered

... for several options.

Reported-by: Ophir Lojkine

Closes #12249

docs/cmdline-opts/header.d

@@ -34,7 +34,8 @@ with no-value then its header must be terminated with a semicolon, such as \-H
 curl makes sure that each header you add/replace is sent with the proper
 end-of-line marker, you should thus **not** add that as a part of the header
 content: do not add newlines or carriage returns, they only mess things up for
-you.
+you. curl passes on the verbatim string you give it without any filter or
+other safe guards. That includes white space and control characters.
 
 This option can take an argument in @filename style, which then adds a header
 for each line in the input file. Using @- makes curl read the header file from

docs/cmdline-opts/request-target.d

@@ -14,3 +14,6 @@ Tells curl to use an alternative "target" (path) instead of using the path as
 provided in the URL. Particularly useful when wanting to issue HTTP requests
 without leading slash or other data that does not follow the regular URL
 pattern, like "OPTIONS *".
+
+curl passes on the verbatim string you give it its the request without any
+filter or other safe guards. That includes white space and control characters.

docs/cmdline-opts/request.d

@@ -12,6 +12,9 @@ See-also: request-target
 Multi: single
 ---
 Change the method to use when starting the transfer.
+
+curl passes on the verbatim string you give it its the request without any
+filter or other safe guards. That includes white space and control characters.
 .RS
 .TP 15
 **HTTP**

docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3

@@ -39,6 +39,9 @@ When you change the request \fImethod\fP by setting
 libcurl behaves or acts in regards to the particular request method, it only
 changes the actual string sent in the request.
 
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
+
 Restore to the internal default by setting this to NULL.
 
 This option can be used to specify the request:

docs/libcurl/opts/CURLOPT_HTTPHEADER.3

@@ -55,7 +55,9 @@ semicolon).
 
 The headers included in the linked list \fBmust not\fP be CRLF-terminated,
 because libcurl adds CRLF after each header item itself. Failure to comply
-with this might result in strange behavior.
+with this might result in strange behavior. libcurl passes on the verbatim
+strings you give it, without any filter or other safe guards. That includes
+white space and control characters.
 
 The first line in an HTTP request (containing the method, usually a GET or
 POST) is not a header and cannot be replaced using this option. Only the lines

docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3

@@ -34,6 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REQUEST_TARGET, string);
 .SH DESCRIPTION
 Pass a char * to string which libcurl uses in the upcoming request instead of
 the path as extracted from the URL.
+
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
 .SH DEFAULT
 NULL
 .SH PROTOCOLS