feat: add strict proxy request semantics

[mcollina]

Add an opt-in first-party semantic validation layer for proxy/server request routing.

strict_proxy_semantics remains disabled by default, preserving Milo's lower-level compatibility. When enabled for requests, Milo now:

• requires exactly one non-empty, syntactically valid initial Host field;
• rejects Host in trailers;
• validates RFC 3986 path/query characters and percent triplets;
• accepts origin-form and absolute-form targets;
• restricts asterisk-form to OPTIONS while preserving the dedicated PRI * HTTP/2.0 path;
• requires authority-form with an explicit port for CONNECT;
• requires absolute-form and CONNECT authorities to match Host case-insensitively, including explicit ports, without default-port inference.

The option defaults false and does not affect response parsing. It is exposed through Rust, native C, and generated WASM APIs. Parser-owned target-authority storage is cleared between messages, on reset, and on destruction.

Mirrored Rust/WASM regressions cover opt-in compatibility, all valid target forms, valid and malformed percent encoding, URI component grammar, missing/empty/duplicate/invalid Host, authority mismatch, CONNECT port requirements, and Host trailers. Documentation now distinguishes the default syntax-only boundary from strict routing validation.

Validation: full Rust suite, rebuilt 101-test SIMD WASM suite, no-SIMD compliance suite, and C++ reference suite pass. Independent review found no SEC-22 blockers.

Merge-order note: this should land after #54, which independently fixes SEC-07 atomic semantic-header event delivery.

This fixes SEC-22 from #38.