fix(negotiation): don't panic on empty q param in SelectQValueFast

[dannyshafer]

SelectQValueFast panics on an Accept header like a;,b (slice bounds out of range [4:3]), which a client can trigger through huma.WriteErr.

When the parameter after ; is empty, the ; branch sets start = pos+1 and end = start, and the , that follows then slices header[start+2:end+1] with a start past the end. The q-value is now parsed only when that slice is non-empty; otherwise the entry keeps the default q of 1.0, the same as other unparseable q-values such as a;q=invalid.

Fixes #1127

Testing

• Added a;,b, a; ,b and the exact input from the issue to TestMalformedFast. They panic on main and pass with this change.
• Ran a throwaway go test -fuzz target over SelectQValueFast for 60s (about 1.9M inputs) with no panics.
• go test ./... passes.

Side note, not changed here: the existing len(header) > end+1 guard means the q-value of the last entry in the header is never parsed, so SelectQValueFast("a;q=0.5,b;q=0.3", {"a","b"}) returns b while SelectQValue returns a. Happy to send a separate PR if you'd like that changed.

This PR was prepared with AI assistance (Claude Code).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.19%. Comparing base (ef50837) to head (08ceea2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1128   +/-   ##
=======================================
  Coverage   93.19%   93.19%           
=======================================
  Files          24       24           
  Lines        5008     5008           
=======================================
  Hits         4667     4667           
  Misses        273      273           
  Partials       68       68           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.