Add Str.split_at_utf8_byte

[ESRogs]

Adds a public Str.split_at_utf8_byte:

split_at_utf8_byte : Str, U64 -> Try({ before : Str, after : Str }, [OutOfBounds, NotACharacterBoundary])

Splits a Str at a byte offset into zero-copy before/after slices. The offset counts UTF-8 bytes (as in Str.count_utf8_bytes) and must be at most the string's length and on a character boundary, so a valid split always yields two valid Strs. The backing intrinsic (str_split_at_utf8_byte_raw, following the str_find_first_raw convention) performs both checks in the shared Zig runtime and returns a flags record — is_out_of_bounds and is_not_char_boundary, each naming one failure, both false on success — that the wrapper maps into Try. No unchecked operation is expressible from Roc.

The JSON string scanner (from roc-lang#10045) uses it to split at the closing quote instead of reconstructing slices via from_utf8 + drop_prefix: O(1) in the string body instead of O(offset).

Performance (interleaved LLVM benchmarks vs the parent commit; each cell is the median wall time for a loop of 20,000 Json.parse calls, default --opt=speed, macOS arm64):

document	parent	this PR
500 short string fields	1.43 s	1.37 s
3 × 4.9 KB string fields	0.17 s	0.15 s
500 escape-bearing fields	1.54 s	1.48 s
500 numeric fields (only the short keys hit the scanner)	1.50 s	1.49 s

Two measured boundaries on where the win applies:

• Backend: on the dev backend (no inlining) the intrinsic call is a small per-string overhead instead; the win applies to optimized builds.
• Split-body size: on an earlier compiler, swapping the intrinsic into the JSON scalar splitter (1-3 byte bodies) measured ~7% slower than pure-Roc slice reconstruction; re-measured on current main, the two are at parity within measurement noise (overlapping spreads, medians 1.53s vs 1.45s on the numeric document across interleaved runs). The win still only appears when the split lands deep inside a long body, since what the intrinsic eliminates is an O(offset) revalidation walk — so this PR keeps it scoped to the string scanner, where bodies are unbounded, and leaves the scalar splitter's pure-Roc slices alone.

Open questions for iteration:

• Name: settled on split_at_utf8_byte for the count_utf8_bytes rhyme.
• Error shape: Try with [OutOfBounds, NotACharacterBoundary] publicly; two named failure flags at the intrinsic layer (a comment on the Zig result struct notes that accumulating more failure modes should trigger a switch to from_utf8-style is_ok + problem code).
• Whether upstream wants a byte-offset operation on Str at all — to be raised on Zulip #API design with this diff as the concrete proposal.