fix(http): decode HTML entities in filenames in one pass (#1651)

unescapeHTMLEntities applied its replacements while ranging over a map,
so the order changed from run to run. An escaped ampersand such as
"a<b.txt" came out as "a<b.txt" or, when & was replaced
first, as the double-decoded "a<b.txt".

Replace all entities in a single pass with strings.NewReplacer and
cover the escaped-ampersand cases in TestUnescapeHTMLEntities, running
each case repeatedly so an order-dependent implementation fails.

internal/protocol/http/filename_parse_test.go

@@ -125,13 +125,26 @@ func TestUnescapeHTMLEntities(t *testing.T) {
 			in:   "normal.txt",
 			want: "normal.txt",
 		},
+		{
+			name: "escaped ampersand before entity name is decoded once",
+			in:   "a<b.txt",
+			want: "a<b.txt",
+		},
+		{
+			name: "escaped ampersand before quote entity is decoded once",
+			in:   "a"b.txt",
+			want: "a"b.txt",
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := unescapeHTMLEntities(tt.in)
-			if got != tt.want {
-				t.Errorf("unescapeHTMLEntities() = %q, want %q", got, tt.want)
+			// Run repeatedly so that an order-dependent implementation fails reliably.
+			for i := 0; i < 200; i++ {
+				got := unescapeHTMLEntities(tt.in)
+				if got != tt.want {
+					t.Fatalf("unescapeHTMLEntities() = %q, want %q (run %d)", got, tt.want, i)
+				}
 			}
 		})
 	}