Align with fasthttp: adopt existing helpers, propose upstream exports and documentation asks

Counterpart to the consolidation issue #4604. Where fiber re-implements something fasthttp already has, adopt it; where fasthttp has it but unexported, propose the export upstream; where fiber relies on undocumented fasthttp behavior, ask for the guarantee to be documented.

Adopt now (fasthttp API already exists)

• req.go Charset hand-rolls parameter splitting; fasthttp.VisitHeaderParams fits and helpers.go getOffer already uses it. Fold into the shared media-type scanner (consolidation issue, cluster 7). Caveat: VisitHeaderParams strips surrounding quotes but does not remove quoted-pair backslash escapes (contrary to its own doc comment) and stops at the first malformed parameter, so fiber's unescapeHeaderValue survives the fold.

Export proposals (file individually upstream, each gated on the consolidation outcome)

• hasHeaderValue (header.go) - comma-list token membership with OWS handling; would replace internal/headerlist Contains (cluster 5).
• appendQuotedPath (bytesconv.go) - path-segment percent-encoder, the path sibling of the exported AppendQuotedArg; needed for Location re-encoding and client path-param escaping (clusters 4 and 13).
• hasDotDotPathSegment (fs.go) - segment-aware .. detection for filesystem guards above fasthttp (cluster 12).
• stringContainsCTLByte (uri.go) - reject path for client-side redirect following (cluster 13).
• normalizePath: considered and dropped - fiber deliberately routes on the raw PathOriginal() and has no consumer for it.

Note for the upstream discussion: appendQuotedPath and normalizePath are already reachable indirectly via URI.SetPath + RequestURI()/Path(); the export ask is about doing it without a URI round-trip.

Documentation asks upstream

• Document that all exported header-value writes filter CR/LF (including SetCanonical, and keys too), so frameworks can delete their own scrubbers.
• Document what parsed request-header values may still contain: no C0 except HTAB, no DEL, bytes >= 0x80 allowed; a violating request is rejected with 400 and the connection closed.
• Document the server-side guarantees for URI().Path() (always decoded and normalized, decode before collapse) and URI().Host() (lowercased and validated at parse time; SetHost only lowercases).

Gap reports upstream (discussion items, not necessarily changes)

• The header-value write filter passes NUL and other C0/DEL bytes and mutates silently instead of rejecting.
• RequestCtx.Redirect appends an attacker-supplied fragment raw into Location.
• On Unix, \ is not a path separator in path normalization - a documented footgun for filesystem code above fasthttp.
• HasAcceptEncoding is a case-sensitive, boundary-checked substring probe on the first hit: no q-values, no *, and false for gzip,br without a space. fasthttp's own CompressHandler negotiates through it, which fiber's compress middleware delegates to.

Stays in fiber by design (no upstream ask)

Content negotiation, ETag policy, origin/trust validation, forwarded-header handling and SameSite mapping are application-level policy that fasthttp deliberately omits; the consolidation issue keeps exactly one fiber implementation of each.

Acceptance

• The adopt-now item is an ordinary fiber PR and does not wait on any upstream outcome.
• Every accepted upstream item links its upstream issue/PR; when an export lands, the corresponding fiber-internal copy is deleted in the same release cycle.