Fix File stat-before-open crash risk, JSON string-quoting bug, and MString buffer overflow

- File: stat() only after a successful open() (previously ran first with
  its result ignored, feeding a missing file's garbage st_size into a
  realloc - could crash the whole APIServer on a request for a
  nonexistent static asset)
- JString::setString(): always quote+escape the value instead of going
  through set()'s literal-value guess, which misclassified any string
  starting with digits (e.g. a UUID) as a bare numeric literal and wrote
  it unquoted, corrupting later edits to the same JSON document
- MString::remove() (both overloads): fixed an off-by-one that read one
  byte past the buffer on a completely full string (found via ASan under
  concurrent load)
- CGIFormData: added fields() so callers can iterate every parsed field
  without knowing names in advance (used to merge POST body into
  jet::Global::variables the same way query-string params already are)

CGIFormData.h

@@ -34,6 +34,14 @@ namespace coreutils {
 
       MString operator[](ZString name);
 
+      // Every parsed field, keyed as "name:N" (see storeValue's own doc
+      // comment below) - lets a caller (ApiSession::handleComplete, to
+      // merge POST body fields into jet::Global::variables the same way
+      // path params/query string already are - see its own doc comment)
+      // iterate every field without knowing its name in advance, which
+      // operator[] alone doesn't support.
+      const std::map<MString, MString> &fields() const { return data; }
+
     protected:
 
       Status parse() override;