Proxy: fixed proxy_request_buffering and chunked with preread body.

If any preread body bytes were sent in the first chain, chunk size was
incorrectly added before the whole chain, including header, resulting in
an invalid request sent to upstream.  Fixed to properly add chunk size
after the header.

src/http/modules/ngx_http_proxy_module.c

diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index d0b1c88..00e8923 100644
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -1503,7 +1503,7 @@
     u_char                *chunk;
     ngx_int_t              rc;
     ngx_buf_t             *b;
-    ngx_chain_t           *out, *cl, *tl, **ll;
+    ngx_chain_t           *out, *cl, *tl, **ll, **fl;
     ngx_http_proxy_ctx_t  *ctx;
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
@@ -1546,6 +1546,7 @@
 
     size = 0;
     cl = in;
+    fl = ll;
 
     for ( ;; ) {
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
@@ -1602,8 +1603,8 @@
         b->pos = chunk;
         b->last = ngx_sprintf(chunk, "%xO" CRLF, size);
 
-        tl->next = out;
-        out = tl;
+        tl->next = *fl;
+        *fl = tl;
     }
 
     if (cl->buf->last_buf) {