fix(http): reject incomplete chunked transfers

[Sunrisepeak]

Summary

• distinguish a complete CRLF line from EOF/timeout in chunked downloads
• reject empty, malformed, and overflowing chunk-size lines
• require chunk delimiters and the terminal trailer terminator
• expose expected byte count, final URL, ETag, and Last-Modified in download results
• bump tinyhttps to 0.2.9 and refresh the mcpp bootstrap/lock configuration

Test plan

• TDD RED: missing parser and metadata contract
• mcpp test — 2 test binaries passed; 12 tests passed
• existing real HTTPS download/redirect/progress tests passed
• git diff --check

Refs openxlings/xlings#356