SQUID-2023:10 Denial of Service in HTTP Request parsing

A remote client sends an HTTP request containing an excessively large `X-Forwarded-For` header (thousands of addresses) to a Squid proxy that has the `follow_x_forwarded_for` directive configured. Each address in the header triggers an immediate `nonBlockingCheck()` callback, causing unbounded indirect recursion in `clientFollowXForwardedForCheck()`. This recursion exhausts the Squid process call stack, resulting in a Denial of Service (DoS) [ref_id=1][ref_id=2].

The vulnerability resides in `src/client_side_request.cc` in the `clientFollowXForwardedForCheck()` function. When the `follow_x_forwarded_for` feature is enabled, each X-Forwarded-For element triggers a recursive call via `nonBlockingCheck()`, with no bound on recursion depth. The patch introduces a hop counter (`currentXffHopNumber`) and a hard limit (`SQUID_X_FORWARDED_FOR_HOP_MAX`, default 64) in `src/ClientRequestContext.h` to break the recursion [ref_id=1][ref_id=2].

The patch introduces a per-request hop counter (`currentXffHopNumber`) and a compile-time limit (`SQUID_X_FORWARDED_FOR_HOP_MAX`, default 64). Before each recursive call to `nonBlockingCheck()`, the counter is incremented and compared against the limit. Once the limit is reached, Squid logs a critical error and falls through to resume normal processing instead of recursing further, preventing stack exhaustion [ref_id=1][ref_id=2].