Fix malformed Accept request header according RFC

[yakimenko73]

Hi! First of all, thank you for locus - it is a genuinely pleasant library to depend on and it has been quietly doing its job in our deployment for a long time :)

The problem

locus_loader:http_base_request_headers/0 joins the acceptable media types with semicolons:

join_http_header_values(Values) ->
    string:join(Values, "; ").

which produces

Accept: application/gzip; application/x-gzip; application/x-gtar; application/x-tgz; application/x-tar; application/octet-stream

RFC 9110, section 12.5.1 defines

Accept      = #( media-range [ weight ] )
media-range = ( "*/*" / ( type "/" "*" ) / ( type "/" subtype ) ) parameters
parameters  = *( OWS ";" OWS [ parameter ] )
parameter   = parameter-name "=" parameter-value

The # list construct (section 5.6.1) is comma-delimited by definition, and senders MUST generate element *( OWS "," OWS element ). The semicolon is reserved for parameters of the preceding media-range.

The current value does not merely carry the wrong meaning — it does not parse at all. application/x-gzip cannot be a parameter: it has no "=", and / is not a tchar, so it is not even a valid parameter-name. Everything after the first semicolon is unparseable against the Accept grammar.

Why it matters in practice

This is not only a spec technicality. Strict intermediaries reject or flag the header - the OWASP Core Rule Set matches rule 920600 ("Illegal Accept header") on every database download at the default paranoia level. Where an IP-reputation tool such as CrowdSec sits on top of the WAF, the repeated "protocol violation" gets the client's address banned outright. That is painful in containerised deployments, where many replicas share one NAT egress address and the ban takes unrelated traffic down with it — and no_cache deployments re-download on every start, so the hits add up quickly.

The change

One separator, "; " → ", ". The set of advertised media types and everything else about the request is unchanged. Both remote origins are covered, since {maxmind, _} and {http, _} share http_request_headers/1.

Three eunit tests are added alongside the existing ones in locus_loader: the exact header value, the absence of semicolons, and that the conditional (if-modified-since) request carries the same Accept. They fail on master and pass with the fix.

Checks

make check-fast (erlfmt, xref, hank, elvis), make check-slow (dialyzer), make eunit (11 tests) and rebar3 ct --suite locus_remote_sources_SUITE (175 tests, including the local-httpd groups that actually put this header on the wire) all pass on OTP 27.

Happy to adjust naming or drop the tests if you would rather keep the diff to the single line :))

[g-andrade]

Thank you for your contribution! Released in version 2.3.16, pushed to Hex.