mask request bytes before ctype calls in client.c

[aizu-m]

ASan, modelling a ctype lookup that indexes its 256-entry table by the raw argument:

ctype_demo.c:12: ERROR: AddressSanitizer: BUS, READ memory access
    #0 main ctype_demo.c:12   // table[c] with c == -128

Spotted while reading the request path. The host parsed from the request URI and the If-Modified-Since header value both reach ctype calls on a bare char. char is signed here, so a request byte of 0x80 or above arrives as a negative int, which isdigit/isspace/isalpha must not be given. The rest of this file already masks with & 255 (see lines 2476 and 3755); these four sites were missed. The two tolower calls a bit further down are already safe, since they run only after an isxdigit check on the same byte.

[michaelrsweet]

Note that platforms where "char" is unsigned don't have this issue, which IIRC includes Linux and macOS. However, I am aware of the issue and thought we had already covered all of the calls that mattered, so thanks for the catch!