fix(builtins): sanitize curl multipart field names to prevent header injection

[chaliy]

Summary

• Add sanitize_multipart_name() that rejects \r/\n and escapes " in field names/filenames
• Early validation before network check (defense in depth)
• Sanitization applied when building Content-Disposition headers in multipart body

Test plan

• Field name with " is properly escaped
• Field name with \r\n is rejected with error (exit 2)
• Normal multipart fields still work
• 5 unit tests + 3 integration tests pass
• All existing curl tests pass

Closes #985