#36124 http: Make `HTTPRequest` update state internally

• Prevent external callers from arbitrarily mutating internal HTTP request states
• Enforce request state transitions automatically rather than relying on caller convention

Encapsulates HTTP request state parsing within `HTTPRequest`. Removes `SetState()` and the individual public loading methods (`LoadControlData`, `LoadHeaders`, `LoadBody`), replacing them with a single `Load()` method that drives state transitions internally, and updates unit tests and the fuzz harness to use the unified API.

Problem: Previously, `HTTPRequest` exposed `SetState()` and granular parse methods, allowing external classes or callers with a request reference to arbitrarily mutate the request's internal state machine.

P4 · cleanup

• P4 because it is an internal encapsulation cleanup in the HTTP server layer
• Turns internal state conventions into compiler-enforced invariants without fixing an active bug

P4 because this is an internal refactoring and encapsulation cleanup within the HTTP server layer. It prevents arbitrary external mutation of `HTTPRequest::State` by turning an internal convention into a compiler-enforced invariant, but does not alter HTTP protocol behavior or fix an active bug.

Membership: Touches the internal HTTP server implementation in src/httpserver.h and src/httpserver.cpp.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0

• Ready for review

CI is passing, merge conflicts are absent, and previous review comments have been incorporated.

Author status: Active; addressed review feedback and kept commits rebased.

Resolved concerns:

• winterrdog and janb84 suggested clarifying the return value and docstrings for `Load()`, which the author added.
• janb84 suggested `Load()` return the state enum rather than a boolean, which the author adopted.
• Related disconnect handling and test cleanups were split out into separate pull requests (#36159, #36160).

• Strong support for replacing conventions with compiler-enforced state transitions (janb84)
• Verified by testing after API adjustments (winterrdog)

Strong: reviewers endorsed replacing convention with compiler-enforced state transitions.

janb84 and winterrdog reviewed and approved the change, citing improved design by removing arbitrary state modifications. No outstanding objections remain.

• janb84 commented: 'The removal of the SetState() makes it a better design (imho), makes the convention based "rule" not to arbitrary set the state, to a compiler-enforced fact'
• janb84 re-ACKed after API adjustments to return State
• winterrdog provided tested ACK

Review verdicts (DrahtBot): 0 (+2)

• Stale ACK: janb84, winterrdog
• Concept ACK: jeanpablojp

124 lines under test/bench/ci.

• src/test/httpserver_tests.cpp +44/-74
• src/httpserver.cpp +45/-41
• src/httpserver.h +26/-25
• src/test/fuzz/http_request.cpp +2/-4

This PR refactors `HTTPRequest` to manage its own internal state machine, eliminating `SetState()` and replacing separate field-loading methods with a single `Load()` method. It solves an encapsulation gap where external callers could arbitrarily manipulate a request's state enum. Reviewers support the change as a cleaner design that turns conventions into compiler-enforced invariants. The PR is clean, has multiple ACKs, and is ready for merge.