Handle bad xmlrpc data with BadRequest

[djay]

helps ignore spam/pentest requests

[dataflake]

I have observed requests like this and similar over the last few months. There are a couple other types that provoke tracebacks like this. The requested URL as stored in REQUEST['ACTUAL_URL'] on all of these requests is None?...unknown...

Traceback (innermost last):

Module ZPublisher.WSGIPublisher, line 181, in transaction_pubevents
Module ZPublisher.WSGIPublisher, line 390, in publish_module
Module ZPublisher.WSGIPublisher, line 252, in publish
Module ZPublisher.HTTPRequest, line 498, in processInputs
Module ZPublisher.HTTPRequest, line 1471, in __init__
Module multipart, line 218, in parts
Module multipart, line 212, in __iter__
Module multipart, line 285, in _iterparse
multipart.MultipartError: Stream does not contain boundary

Traceback (innermost last):

Module ZPublisher.WSGIPublisher, line 181, in transaction_pubevents
Module ZPublisher.WSGIPublisher, line 390, in publish_module
Module ZPublisher.WSGIPublisher, line 252, in publish
Module ZPublisher.HTTPRequest, line 544, in processInputs
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xad in position 0: invalid start byte

[d-maurer]

Please add a changelog entry

[dataflake]

I have added the change log entry and merged it myself because I want this on master before creating a branch to work on the other types of spam/pen test requests I have been seeing.

[djay]

@dataflake there is another. A call like blah.jpg/@@images (ie missing the rest of the path). Then you get

ViewNotCallableError: __call__
  File "ZPublisher/WSGIPublisher.py", line 181, in transaction_pubevents
    yield
  File "ZPublisher/WSGIPublisher.py", line 391, in publish_module
    response = _publish(request, new_mod_info)
  File "ZPublisher/WSGIPublisher.py", line 269, in publish
    obj = request.traverse(path, validated_hook=validate_user)
  File "ZPublisher/BaseRequest.py", line 483, in traverse
    object, default_path = adapter.browserDefault(self)
  File "/app/eggs/zope.browserpage-4.4.0-py3.9.egg/zope/browserpage/metaconfigure.py", line 434, in browserDefault
    meth = getattr(self, attr)
  File "app/eggs/Zope-5.8.5-py3.9.egg/Products/Five/browser/metaconfigure.py", line 448, in __call__
    raise ViewNotCallableError('__call__')

Which I think should also be a BadRequest.
If you don't want to handle it I can open another PR.