Expire the cookie on Set-Cookie Max-Age=0

[dylanpulver]

Max-Age=0 is the standard way for a server to delete a cookie, but
readsetcookies dropped the attribute instead of recording it. The
leading-zero guard rejects any value whose first character is 0, which
catches "0" itself, so the parsed Cookie kept maxage == 0 (attribute
absent) and CookieJar stored the cookie rather than deleting it. A logout
that clears a session with Set-Cookie: sid=; Path=/; Max-Age=0 left the
stale entry in the jar, to be sent on every later request.

Reject a leading zero only on a non-zero value, and map every delta-seconds
<= 0 to the maxage == -1 deletion sentinel (RFC 6265 5.2.2). This also
closes a round trip inside the package: stringify already serializes a
deletion as Max-Age=0, which the parser could not read back. Max-Age=01
is still ignored and positive values are unchanged.

Cross-checked against Go's net/http, which this parser follows: there
Max-Age=0 and Max-Age=-0 both give MaxAge=-1 and the jar drops the
cookie, while Max-Age=01 is ignored in both. Full Pkg.test() is green on
Julia 1.12.7 (macOS aarch64).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.42%. Comparing base (769b917) to head (aef652f).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1357   +/-   ##
=======================================
  Coverage   89.41%   89.42%           
=======================================
  Files          31       31           
  Lines       12594    12592    -2     
=======================================
- Hits        11261    11260    -1     
+ Misses       1333     1332    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.