fix: encode control characters in $upstream_uri to prevent CRLF injection (#13787)