http2: fix race in writePushPromise

Writing the PUSH_PROMISE can happen concurrently with the request
handler, so we should pass the request handler a cloned Header..

Updates golang/go#18326

Change-Id: I918e7ffbc02459b9ede3226f4bd3c56a6a3b350f
Reviewed-on: https://go-review.googlesource.com/34493
TryBot-Result: Gobot Gobot <gobot@golang.org>
Run-TryBot: Tom Bergan <tombergan@google.com>
Reviewed-by: Chris Broadfoot <cbro@golang.org>

http2/server.go

@@ -2589,7 +2589,7 @@ func (sc *serverConn) startPush(msg startPushRequest) {
 			scheme:    msg.url.Scheme,
 			authority: msg.url.Host,
 			path:      msg.url.RequestURI(),
-			header:    msg.header,
+			header:    cloneHeader(msg.header), // clone since handler runs concurrently with writing the PUSH_PROMISE
 		})
 		if err != nil {
 			// Should not happen, since we've already validated msg.url.