mod simd_parsers

Three primitives:

• simd_memmem(haystack, needle) — find the first occurrence of needle in haystack. Specialised for the multipart boundary scan, which is the dominant cost of parsing multipart/form-data uploads (every body chunk must be scanned for the per-request boundary delimiter --<boundary>).
• simd_percent_decode(input, out) — RFC 3986 §2.1 percent-decoder for URL-encoded query-string and form-body fragments. Bulk-scans for % escape markers and copies unescaped runs in one append_span call instead of byte-by-byte.
• simd_cookie_scan(input) — split a Cookie / Set-Cookie header value on ; delimiters in one pass, returning the byte-offset list of separators so the caller can build cookie name/value pairs without per-byte iteration.

Why this is a Track B subtrack

Mojo's stdlib Span[UInt8] doesn't ship a vectorised memmem / percent-decode / cookie-split primitive yet. The HTTP/1.1 parser hot path today loops byte-at-a-time for each of these — fine for small payloads but linear in the input size with a per-byte branch cost that dominates above ~4 KiB.

The "SIMD" in B10 refers to the eventual SSE4.2 / AVX2 vectorised inner loop using PCMPESTRI / PSHUFB — that inner-loop swap is a follow-up commit. This commit lands the clean public API + correct scalar implementations + property tests. All future SIMD acceleration plugs in behind the same function signatures. Same approach as B9 (canonical decoder ships first; SIMD swap follows).

What this commit ships

• simd_memmem(haystack, needle) -> Int — return the byte-offset of the first match, or -1 on no match. Empty needle returns 0 by convention (the empty string matches at every position; we report the first). Linear-time Rabin-Karp-flavoured scan: pre-computes a rolling hash of the needle, walks the haystack with a sliding window, byte-compares on hash hit. Slower than Boyer-Moore on pathological adversarial input but no per-position table setup cost.
• simd_percent_decode(input, out) raises HttpParseError — appends the percent-decoded form of input to out. Raises on malformed percent-escapes (lone % at end of input, % followed by non-hex, etc.).
• HttpParseError — typed enum-style error. Variants: TRAILING_PERCENT (lone % at end), INVALID_HEX (% followed by a non-hex byte).
• simd_cookie_scan(input, mut offsets: List[Int]) — appends the byte offsets of every ; to offsets. Caller reconstructs the cookie name/value pairs by slicing input[prev:offset].

These primitives don't touch the wire-protocol semantics — they are byte-level helpers. Wiring into the multipart parser (flare.http.multipart), the form decoder (flare.http.form), and the cookie parser (flare.http.cookie.parse_cookie_header) is a follow-up commit that swaps the per-byte loops for these helpers without changing public APIs.