feat(http): harden incremental HTTP/1 downloads

[bowyern]

Summary

• replace the HTTP/1 download path with an incremental body reader for content-length, chunked, bodyless, and EOF-delimited responses
• preserve duplicate headers and expose trailers without buffering the complete body
• reject conflicting or malformed framing, unsupported upgrades/transfer encodings, and oversized response heads, chunk lines, or trailers

Why

This is the bounded HTTP/1 reader needed by the public streaming response API. The stricter framing rules also prevent ambiguous message boundaries and unbounded metadata growth on attacker-controlled responses.

Stack

Part 2 of 8. Stacked on #17; review and merge #17 first.

Both PRs target main, following the repository's existing contributor-stack convention, so this PR's GitHub diff is cumulative until #17 merges. The unique commit for this layer is 2718065.

Verification

• tests/http/test_download_decoder.mojo
• focused streaming test suite passed after rebasing the complete stack onto current main
• Mojo formatter clean
• git diff --check clean