feat: WHATWG URL component setters and expanded conformance test coverage

[OmarAlJarrah]

Summary

Adds a WHATWG-conformant URL component setter API to Url, and closes the two
remaining WPT conformance gaps versus reference implementations (URL setters and
percent-encoding). Also adds three test forms that go beyond replaying fixed
corpora: round-trip invariants, a java.net differential, and a seeded fuzzer.

Setter API (Url)

Nine immutable setters, each implementing the corresponding WHATWG URL setter
algorithm and returning a new Url (or the receiver unchanged when the setter is
a no-op):

• withProtocol, withUsername, withPassword
• withHost, withHostname, withPort(String)
• withPathname, withSearch, withHash

These follow the WHATWG contract of being no-ops on invalid input rather than
throwing — the deliberate difference from Url.Builder, which validates and throws.
withPort(String) is a new overload alongside the existing withPort(Int?)
convenience.

Internally they reuse the existing parser state machine through a new state-override
entry point (UrlParser.parseWithOverride), so the setters share the same
conformance-tested engine as full parsing rather than reimplementing component
parsing. The public getter surface is unchanged; new methods are captured in the JVM
and Android API snapshots.

Conformance suites

• URL setters — runs the WPT setters_tests.json corpus (278 cases) against the
  new setters via a getter adapter, ratcheted against a known-failures baseline like
  the existing URL parsing suite. All cases pass except two, which are tracked: both
  are the invalid ACE label xn-- being accepted by host parsing — a pre-existing
  IDNA host-validity gap that also affects full parsing and is out of scope here.
• Percent-encoding — runs the WPT percent-encoding.json corpus against the
  percent codec (empty known-failures).

Both fixtures are generated from the vendored WPT corpora by new Go generators under
tools/internal/codegen/ (generateSetterTestData, generatePercentEncodingTestData),
consistent with the existing fixture generation.

Beyond fixed corpora

• Round-trip invariants — over the WPT parsing corpus, asserts serialization is
  idempotent and newBuilder().build() reproduces the original href. This caught a
  real defect: making the pathname getter WHATWG-correct (excluding the /. path
  prefix) had left the builder's recompose path without that prefix, so an
  authority-less URL whose path begins with // failed to rebuild. Fixed by having the
  builder pre-fill from the guarded full-URL path serialization; the getter stays
  spec-correct.
• java.net differential — compares parsing against java.net.URI on aligned
  inputs and documents the intentional WHATWG-vs-RFC-3986 divergences (host
  case-folding, backslash-to-slash for special schemes) with a rationale per row.
• Seeded fuzzer — deterministic generative inputs asserting the parser never throws
  and that any successful parse serializes idempotently.

Follow-ups (out of scope)

• Host parsing accepts the empty ACE label xn--; teaching domain-to-ASCII to reject
  it belongs with the IDNA engine and its reference lock-step.
• The Uri profile may share the same path-getter/serialization conflation that was
  fixed here for Url; worth a look separately.

Testing

./gradlew build passes across all targets (JVM, JS, Wasm, native); the full JVM
suite is green (URL parsing, IDNA, NFC, href round-trip, the two new conformance
suites, and the three invariant/differential/fuzz suites). API snapshots regenerated
for the new setters.