Fix string.well_known_regex to reject comma in header names

[timostamm]

RFC 7230 doesn't permit a comma (,) in header names, but (buf.validate.field).string.well_known_regex = KNOWN_REGEX_HTTP_HEADER_NAME fails to reject it.

This fixes the regular expression, and adds a test to assert rejection, and a test to cover all permitted characters.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 3, 2026, 11:30 AM

[timostamm]

The cause of the bug was +-. in the character class. It's a range that expands to +,-..

The most direct fix is to quote the hyphen, but it would need to be \\\\- in validate.proto because of the two layers of escaping (prototext and CEL).

Moving the hyphen to the end has the same effect (no longer a range) but doesn't require escaping.

Reproduction:

header/v1/header.proto:

syntax = "proto3";
package header.v1;
import "buf/validate/validate.proto";

message Header {
  // The regular expression in `string.well_known_regex.header_name`
  string name = 1 [(buf.validate.field).cel = {
    // original, broken:
    //expression: "this.matches('^:?[0-9a-zA-Z!#$%&\\'*+-.^_|~\\x60]+$')"

    // fixed:
    expression: "this.matches('^:?[0-9a-zA-Z!#$%&\\'*+.^_|~\\x60-]+$')"
  }];
}

main.go:

package main

import (
	headerv1 "example/internal/gen/header/v1"
	"fmt"

	"buf.build/go/protovalidate"
)

func main() {
	h := &headerv1.Header{Name: ","}
	err := protovalidate.Validate(h)
	fmt.Printf("%q %t\n", h.GetName(), err == nil)
}

The output is "," true with the original, "," false with the fixed expression.