CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`

Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. `Curl_setstropt()` (`lib/setopt.c`) stores each option string after checking only the 8 MB length cap …

// lib/setopt.c:88-96  (Curl_setstropt)
if(strlen(s) > CURL_MAX_INPUT_LENGTH)
    /* …too long… */;
else
    dest = curlx_strdup(s);   // no CR/LF (or control-char) check; CRLF preserved verbatim