x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

[rolandshoemaker]

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers.

This is a PRIVATE issue for CVE-2022-32149, tracked in http://b/238189978 and fixed by http://tg/1565112

/cc @golang/security

[gopherbot]

Change https://go.dev/cl/442235 mentions this issue: language: reject excessively large Accept-Language strings