security: fix CVE-2023-39325 [1.21 backport]

[gopherbot]

@neild requested issue #63417 to be considered for backport to the next 1.21 minor release.

@gopherbot please open backport issues

[gopherbot]

Change https://go.dev/cl/534235 mentions this issue: [release-branch.go1.21] net/http: regenerate h2_bundle.go

[gopherbot]

Closed by merging 24ae2d9 to release-branch.go1.21.

[gopherbot]

Change https://go.dev/cl/534218 mentions this issue: [internal-branch.go1.21-vendor] http2: limit maximum handler goroutines to MaxConcurrentStreams

[gopherbot]

Change https://go.dev/cl/534415 mentions this issue: [release-branch.go1.21] all: tidy dependency versioning after release