Parse parameterized multipart headers.

[samuel-williams-shopify]

Summary

Add Protocol::Multipart::Header for strict, linear parsing of parameterized multipart header values, including Content-Type and Content-Disposition. It supports token and quoted values, quoted-pair escapes and UTF-8 quoted filenames while rejecting malformed syntax, duplicate parameters, control characters and folded values.

Add Protocol::Multipart::Headers, backed by Protocol::HTTP::Headers with a multipart-specific policy. Parsed parts preserve ordered header fields and repeated extension fields, while duplicate singular MIME metadata such as Content-Type and Content-Disposition is rejected. Part header lines reject obsolete folding, whitespace before the colon and embedded control characters.

This avoids the parsing ambiguities and super-linear compatibility paths that have repeatedly caused Rack multipart vulnerabilities. The initial protocol-http dependency keeps the implementation focused; the generic header container can be extracted later if another protocol needs it.

Testing

• bake test
• bake covered:validate --paths .covered.db
• rubocop
• bake decode:index:coverage lib