loader: include the standard HTTP cookie jar

[yohimik]

Problem

The net/http directory override hides Go's net/http/cookiejar package. Crier imports it through its client dependencies. Its TinyGo build currently needs a manual copy into TINYGOROOT.

Change

Merge the net/http directory while keeping the TinyGo HTTP implementation and all its existing subpackage overrides. This exposes Go's pure cookie jar package without a vendored copy. There is no change to the netdev, transport, TLS selection or HTTP redirects.

This is independent of #5635 and tinygo-org/net#72 through #82. A source merge with #5635 must retain its additional pathsToOverride argument. No commit from those PRs is included here.

Tests

The loader test checks that HTTP files and the existing httptest and internal subpackages still come from TinyGo, while cookiejar comes from Go. A host test stores a secure cookie and checks that it is not returned for an HTTP URL.

The merge test passed in a small harness using the exact production merge functions. The cookie test passed with ordinary Go on Darwin arm64. Full local loader tests could not build because LLVM development headers are not installed. Fork CI at 99279a3 passed all 24 checks. See Linux, macOS, and Windows. This verifies the independent branch. Full Crier acceptance with the new combined compiler is still pending.

CI found that the Nix job initialized musl and bdwgc but not src/net. The HTTP merge needs that source directory. Commit 99279a3 adds src/net to that job's existing submodule checkout. The Nix rerun passed at 99279a3. The earlier failure is not counted as a pass.

Current Crier evidence

The Crier report separates the original size comparison from a new CI-built candidate test. The original stripped Linux ARM64 result is 13,829,248 bytes versus Go's 30,277,794 bytes. Two render fixtures exceed pixel tolerance.

Candidate e7d34c8c126e0eecd2ce711915f2f88d112d833a, with net 0f460803, passed all 24 fork CI checks. Its downloaded compiler artifacts, with no source overlays, build unchanged Crier 7edaff9. Linux ARM64 E2E passed 143 cases with no failures or skips. Darwin ARM64 passed 142 with no failures and one platform trust-store skip. Darwin startup now works. A separate Darwin local-TLS matrix passes certificate rejection, plaintext refusal, update to a Go 1.1.0 target, and offline rollback. Both platforms pass spawn, signal, cookiejar, os/fcntl, and network probes.

These are combined-candidate results, not proof that this PR alone supplies all features. No new pixel or stripped-size comparison, amd64 execution, or current Dispat acceptance is claimed. WaitDelay and the recorded net limits remain open. No fork release was published.