Restrict header values by following specification

[amkisko]

A language tag (which is sometimes referred to as a "locale identifier"). This consists of a 2-3 letter base language tag that indicates a language, optionally followed by additional subtags separated by '-'. The most common extra information is the country or region variant (like 'en-US' or 'fr-CA') or the type of alphabet to use (like 'sr-Latn'). Other variants, like the type of orthography ('de-DE-1996'), are usually not used in the context of this header. Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language

The importance of a value is marked by the suffix ';q=' immediately followed by a value between 0 and 1 included, with up to three decimal digits, the highest value denoting the highest priority. When not present, the default value is 1. Reference: https://developer.mozilla.org/en-US/docs/Glossary/Quality_values

[amkisko]

Lack of filtering leads to possibility of getting exceptions here:

accept_language.rb/lib/accept_language/matcher.rb

Line 55 in 978791a

return available_langtag if available_langtag.match?(/\A#{preferred_tag}/i)

-- due to uncontrolled user input directly passed as regular expression