fix: sanitize metric label values to prevent panic on invalid UTF-8

[insider89]

Problem

A malformed public request whose URI contains non-UTF-8 bytes (e.g. GET /\xc0) is turned into a REST request method string of the form "<VERB>#<path>", i.e. "GET#/\xc0". That method string is then used verbatim as a Prometheus label value.

client_golang panics when a label value is not valid UTF-8:

panic: label value "GET#/\xc0" is not valid UTF-8

prometheus.(*CounterVec).WithLabelValues
  flow.(*BaseExecutionFlow).processRequest.func1
    internal/upstreams/flow/execution_flow.go
created by flow.(*BaseExecutionFlow).processRequest

The panic happens inside the detached goroutine spawned in processRequest, which has no recover(), so it tears down the whole process (exit 2). Because the REST endpoint is public, any client can send a single malformed request and trigger a crash loop.

Affected label sites

Every label value derived from request.Method():

• internal/upstreams/flow/execution_flow.go — requestTotalMetric, requestErrorsMetric
• internal/upstreams/flow/request_processor.go — hedgeMetric
• internal/dimensions/dims.go — request total/errors/retries/duration (via the dimension key)

Fix

Add utils.SanitizeMetricLabel, which returns valid UTF-8 unchanged and replaces invalid byte sequences with the Unicode replacement character (U+FFFD), and apply it to every label value derived from request.Method().

The change is confined to the metric boundary — request routing, spec-method resolution and upstream forwarding all still see the original, unmodified method string, so there is no behavioral change for legitimate traffic.

Tests

pkg/utils/strings_test.go:

• valid input is returned unchanged
• the exact production byte sequence (GET#/ + 0xC0) becomes valid UTF-8
• a CounterVec.WithLabelValues call with the sanitized value does not panic (direct regression for the crash)

go build ./... and go test ./pkg/utils/ ./internal/upstreams/flow/ ./internal/dimensions/ pass.