docs(cookie): add API reference page for cookie.h (issue #272)

[Bhumika-1432006]

Fixes #272

Problem

include/cwist/net/http/cookie.h exposes six public functions and one
options struct for reading the request Cookie header and writing
Set-Cookie response headers. None of them appear in docs/, README.md or
any tutorial, so a user has to read the header and cookie.c to learn
how values are encoded, which attributes are written, and what each
call returns on failure.

Fix

Add docs/api/cookie.md in the same format as docs/api/query.md (header
line, then one section per function with its signature and a
description), and link it from the module list in docs/API.md. The page
covers:

• cwist_cookie_parse: parses a Cookie header value of the form
  "name1=value1; name2=value2" into a cwist_query_map. Whitespace before
  a name and after a name is removed; whitespace at the end of a value
  is kept. Each value is URL-decoded. Pairs with no "=", with an empty
  name, or whose decoded value does not fit in 4096 bytes are skipped.
  A NULL map, or a NULL or empty header, does nothing.
• cwist_cookie_get: returns the decoded value stored for a name, or NULL
  if there is none. The pointer belongs to the map and is valid until
  the map is destroyed.
• cwist_cookie_options: path, domain, max_age_seconds, http_only,
  secure and same_site. A NULL path, domain or same_site is left out;
  http_only and secure are written only when true; max_age_seconds is
  written whenever it is 0 or greater, so a zero-initialised struct
  produces "Max-Age=0". same_site is copied as given and is not checked
  against "Strict", "Lax" or "None".
• cwist_cookie_set: adds a Set-Cookie header in the form
  "name=; Path=...; Domain=...; Max-Age=...; HttpOnly;
  Secure; SameSite=...". The value is encoded with cwist_cookie_encode;
  the name and attribute strings are written as given. A NULL value is
  sent as an empty value and a NULL opts sends only "name=value". It
  returns 0 on success and -1 if res or name is NULL, an allocation
  fails, or the header is rejected because it contains a CR or LF.
• cwist_cookie_delete: adds "name=; Path=/; Max-Age=0". The path is
  fixed to "/", so a cookie set with a different path is not matched.
  It returns 0 on success and -1 on failure.
• cwist_cookie_encode: percent-encodes a string. A-Z a-z 0-9 - _ . ~
  are kept and every other byte becomes %XX with upper-case hex digits
  (a space becomes %20). It returns a heap string for the caller to
  release with cwist_free(), or NULL if the input is NULL or allocation
  fails.
• cwist_cookie_decode: decodes into a caller buffer. %XX (upper or
  lower case hex) becomes the byte it names, "+" becomes a space, and a
  "%" not followed by two hex digits is copied unchanged. It returns the
  number of bytes written without the terminating NUL, or -1 if an
  argument is NULL, the buffer size is 0, or the result does not fit
  together with the terminating NUL.
• An example handler that reads a "theme" cookie from the request and
  sets a "session_id" cookie with Path, Max-Age, HttpOnly, Secure and
  SameSite on the response.

Verification

• make test_cookie: "All cookie tests passed!"
• The example in the page compiles with -Wall and was run: it reads
  theme=dark from a Cookie header and produces
  "session_id=abc%20123; Path=/; Max-Age=3600; HttpOnly; Secure;
  SameSite=Lax".
• Checked by running, with the results stated in the page: a
  zero-initialised cwist_cookie_options produces "a=b; Max-Age=0"; a
  NULL opts produces "c=d"; a CR or LF in the cookie name makes
  cwist_cookie_set return -1; cwist_cookie_decode("abc", out, 4)
  returns 3 and cwist_cookie_decode("abc", out, 3) returns -1.
• Every behaviour listed above was read from src/net/http/cookie.c and
  src/net/http/http.c (cwist_http_header_add rejects CR and LF).
• ASCII check on the new file: clean.

Scope

• No changes to cookie.h, cookie.c or any test.
• The page describes the code as it is today. It does not describe
  planned work.