A server Handler (e.g. a proxy) can receive a Request, and
then turn around and give a copy of that Request.Body out to
the Transport. So then two goroutines own that Request.Body
(the server and the http client), and both think they can
close it on failure.  Therefore, all incoming server requests
bodies (always *http.body from transfer.go) need to be
thread-safe.

Fixes #6995

R=golang-codereviews, r
CC=golang-codereviews
https://golang.org/cl/46570043