Introduce CookieValue nominal type

[colincasey]

Part of #581.

Motivation

RFC 6265 §4.1.1 defines cookie-value as *cookie-octet or DQUOTE *cookie-octet DQUOTE where cookie-octet excludes CTLs, whitespace, DQUOTE, comma, semicolon, and backslash. Currently Cookie.value is typed as plain string, identical to Cookie.key and every other string in the API.

Current usage

class Cookie {
  key: string    // same type
  value: string  // same type — nothing prevents swapping
}

Nominal type design

declare const tag: unique symbol;

export type CookieValue = string & { readonly [tag]: true };

export namespace CookieValue {
  /** Parse and validate a cookie value per RFC 6265 §4.1.1. */
  export function parse(input: string): CookieValue | undefined {
    // Validate against cookie-octet grammar
    // Empty string is valid (RFC allows *cookie-octet)
    if (!/^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*$/.test(input)) {
      return undefined;
    }
    return input as CookieValue;
  }
}

API-compatible refactoring strategy

Unchanged public surfaces

• Cookie.value remains string
• CreateCookieOptions.value remains string
• SerializedCookie.value remains string

Internal usage

• CookieJar internals and Cookie.validate() can delegate to CookieValue.parse()
• Distinguishes cookie values from cookie names at the type level internally, preventing mix-ups