Fix File stat-before-open crash risk, JSON string-quoting bug, and MString buffer overflow

- File: stat() only after a successful open() (previously ran first with
  its result ignored, feeding a missing file's garbage st_size into a
  realloc - could crash the whole APIServer on a request for a
  nonexistent static asset)
- JString::setString(): always quote+escape the value instead of going
  through set()'s literal-value guess, which misclassified any string
  starting with digits (e.g. a UUID) as a bare numeric literal and wrote
  it unquoted, corrupting later edits to the same JSON document
- MString::remove() (both overloads): fixed an off-by-one that read one
  byte past the buffer on a completely full string (found via ASan under
  concurrent load)
- CGIFormData: added fields() so callers can iterate every parsed field
  without knowing names in advance (used to merge POST body into
  jet::Global::variables the same way query-string params already are)

JString.h

@@ -56,6 +56,18 @@ namespace coreutils {
 
       void set(ZString &path, ZString &value);
 
+      ///
+      /// Inserts/replaces path with already-formatted, valid JSON text
+      /// (a quoted+escaped string, or a bare number/bool/null literal) -
+      /// the locate()/skipValue()/insert() mechanics set() and setString()
+      /// both share, factored out so setString() can force string quoting
+      /// unconditionally instead of going through set()'s own
+      /// isLiteralValue() guess (see setString()'s own comment in the
+      /// .cpp for why that guess is wrong for a string setter).
+      ///
+
+      void setFormatted(ZString path, MString formatted);
+
       ///
       /// Use the find method to look through an object for member specified by
       /// the key in parameter 1. The cursor must be pointing to the { character