Apply NUL preprocessing to unquoted CSS URLs

[adamziel]

Recognizes unquoted CSS URLs that contain a NUL byte, so URL rewriting does not skip them.

CSS replaces NUL with U+FFFD before it decides which token to produce. The parser already applied that replacement when reading a value, but its unquoted URL check rejected the raw NUL first. This change lets that byte reach the existing decoder. See CSS input preprocessing.

Examples

<NUL> below means one zero byte in the input, not the five printed characters.

Input	Before	After
url(a<NUL>b)	Bad URL token; skipped by the URL iterator.	URL token with the value a�b.
url(a<NUL>)	Bad URL token.	URL token with the value a�.
url(a <NUL>)	Bad URL token.	Still invalid: text follows trailing whitespace.

Other forbidden control bytes, such as 0x01, still produce bad URL tokens. The original NUL stays in the raw source and saved cursor. Source offsets therefore still refer to the original file. Unchanged CSS keeps its original bytes.

Testing

The new tests cover NUL at each position in a URL, consecutive NULs, escaped NUL, EOF, CRLF, and every other forbidden ASCII control byte. Each case also runs at every possible two-chunk split, with JSON state restored between chunks.

Real-file tests use child PHP processes. They rewrite a NUL-containing URL, keep a bad URL unchanged, and continue to a later valid URL. Streaming tests place NUL at the end of the second 32 KiB read and resume after stops before and after saving state. They check the exact output, the unchanged source, and both saved file offsets.

On base commit 8e411e7c, 18 new cases fail, including all four new file-based cases. With this change, all 98 new cases pass. The full DataLiberation suite passes with 2,716 tests and 16 skips. PHP CodeSniffer passes.

This PR is based on trunk and does not depend on #314.