fix: validate end < size when parsing Content-Range headers

The `FromStr` impl for `HttpContentRange` constructed `Bound` directly,
bypassing the `end < size` validation that `Bound::new()` enforces.
Headers like `bytes 10-20/15` were incorrectly accepted.

Author: paolobarbolini

src/headers/content_range.rs

@@ -86,10 +86,15 @@ impl FromStr for HttpContentRange {
             (ParsedRange::Range(range), ParsedSize::Star) => {
                 Ok(Self::Bound(Bound { range, size: None }))
             }
-            (ParsedRange::Range(range), ParsedSize::Value(size)) => Ok(Self::Bound(Bound {
-                range,
-                size: Some(size),
-            })),
+            (ParsedRange::Range(range), ParsedSize::Value(size)) if range.end() < size => {
+                Ok(Self::Bound(Bound {
+                    range,
+                    size: Some(size),
+                }))
+            }
+            (ParsedRange::Range(_), ParsedSize::Value(_)) => {
+                Err(ParseHttpRangeOrContentRangeError::MalformedRange)
+            }
         }
     }
 }