fix(http_parser): fix chunked size overflow and MediaType.toString quoting - #2001

Rationale

1. 64-bit chunk size overflow in ChunkedCodingDecoder (_Sink._decode): Chunk sizes were accumulated via _size = (_size << 4) + digit without checking for integer overflow, and chunk body bounds were computed as math.min(end, start + _size). A 16-digit hexadecimal chunk size >= 0x8000000000000000 (or start + _size when start > 0) overflowed signed 64-bit int to a negative index and threw RangeError in Uint8Buffer.addAll instead of FormatException, while 17+ hex digits truncated the declared chunk size.
2. Unescaped backslashes and unquoted empty parameter values in MediaType.toString(): In 4.1.2, _quotedString in scan.dart was tightened to disallow unescaped \ in qdtext, but _escapedChar in media_type.dart remained RegExp(r'["\x00-\x1F\x7F]') (missing \\). Any parameter value containing \ (foo="bar\\baz" or trail="end\\") was serialized without escaping \, corrupting bar\baz to barbaz on re-parse and turning trailing backslashes (trail="end\\") into an unterminated quoted string (trail="end\") that threw FormatException in MediaType.parse(). Empty parameter values (foo="") also failed nonToken.hasMatch("") and serialized as foo=, throwing FormatException on re-parse.

Summary of Changes

• pkgs/http_parser/lib/src/chunked_coding/decoder.dart: Check if (_size > _maxSizeBeforeShift) before accumulating _size = (_size * 16) + digit in _State.size, throwing FormatException('Chunk size is too large.', bytes, start), compute final bytesToRead = math.min(end - start, _size) in _State.body, and remove unused name/toString() members on private enum _State.
• pkgs/http_parser/lib/src/media_type.dart: Add \\ to _escapedChar (RegExp(r'["\x00-\x1F\x7F\\]')) and quote empty parameter values (if (value.isEmpty || nonToken.hasMatch(value))).
• pkgs/http_parser/test/chunked_coding_test.dart, pkgs/http_parser/test/media_type_test.dart, & pkgs/http_parser/CHANGELOG.md: Add regression tests for 64-bit chunk size overflows and MediaType.toString() / MediaType.parse() round-tripping (159 tests passing), and document under 4.1.3-wip.

Verification

• dart analyze --fatal-infos: exit 0
• dart format --output=none --set-exit-if-changed .: exit 0
• dart test -p vm -c source & dart test -p node: exit 0 (159 tests passed)