Add typed cookie parsing and Set-Cookie rendering

[lukewilliamboswell]

Summary

• add a pure Roc Cookie module that preserves request cookie order, duplicates, and case while strictly validating names and values
• render one validated Set-Cookie header per cookie, including Path, Domain, Max-Age, Secure, HttpOnly, SameSite, security-prefix rules, and a scoped deletion helper
• exercise duplicate Cookie and Set-Cookie fields through the real hello-web listener

This is stacked on #206; its base can be retargeted to main after that PR merges. The implementation adds no host ABI and remains bounded by the existing request-header limits.

Verification

• python3 scripts/test.py with the nightly pinned by .roc-version (all 52 runtime cases passed)
• Roc platform tests (231 expectations)
• generated Rust glue check

Closes #199