Bound header field name size before validating

[Kludex]

Summary

Fixes a regression introduced in #295.

That PR rewrote HEADER_FIELD to find the colon and validate the whole field-name span at once. The size check (advance_header_size) ran after slicing and translate-validating the span, so a header field name with no colon arriving in one large write() chunk got sliced and scanned in full before the max_header_size limit was applied - the limit no longer bounded the work or temporary allocation for an oversized name.

This moves advance_header_size to before the slice/validate, so an over-limit field name fails fast as it did prior to #295.

For an 8 MiB field-name chunk with the default 4 KiB limit, parser-side temporary allocation drops from ~16 MiB back to ~4 KiB; behaviour for valid input is unchanged.

Correctness

• All existing tests pass; 100% coverage; mypy + ruff clean.
• Differentially fuzzed against the pre-Speed up multipart header parsing and callback dispatch #295 implementation: identical callback event streams and identical exception classes across randomized bodies x every chunk-split strategy (including byte-by-byte), at small and default header limits.
• Starlette 1.2.1's tests/test_formparsers.py (40 tests) pass against this branch.

AI Disclaimer

This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.

[codspeed-hq]

Merging this PR will not alter performance

✅ 5 untouched benchmarks

---

_{Comparing perf/bound-header-name-size (1e4b3f3) with main (e0c4f9d)}

[cubic-dev-ai]

No issues found across 1 file

<sub>Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more

Re-trigger cubic</sub>