Reject invalid percent-encoding in ISO-8859-1 ext-value

[spokodev]

Problem

decodeExtended() handles a malformed percent-encoding (a % not followed by two hex digits) inconsistently between the two RFC 8187 charsets:

• UTF-8 path → decodeURIComponent throws → the value is rejected (undefined).
• ISO-8859-1 path (decodeHexEscapes) → keeps the literal % and returns a string.

RFC 8187 §3.2.1 defines value-chars = *( pct-encoded / attr-char ) with pct-encoded = "%" HEXDIG HEXDIG, and attr-char does not include %, so a bare or short % is non-conformant for both charsets; the two paths should behave the same.

Because a successfully decoded filename* overrides filename (RFC 6266 §4.3), the lenient ISO-8859-1 path lets a malformed filename* clobber a valid filename fallback:

parse('attachment; filename="invoice.pdf"; filename*=ISO-8859-1\'\'report%2').parameters.filename
// before: 'report%2'   (malformed ext-value overrides the fallback)
// after:  'invoice.pdf'

This asymmetry was introduced in #127, which tightened only the UTF-8 branch.

Fix

Make decodeHexEscapes return undefined on a malformed percent-encoding, mirroring the UTF-8 path. decodeExtended already propagates undefined, so the unprocessable ext-value is ignored and the filename fallback is preserved. Valid percent-encoding and bare-ASCII ext-values are unaffected.

Verification

• Two new tests: a malformed ISO-8859-1 filename* is ignored, and a valid filename fallback is preserved. Both fail on the base branch and pass with the fix.
• Independent RFC 8187 §3.2.1 reference decoder, fuzzed over malformed/valid percent inputs: the ISO-8859-1 path now matches the reference (0 divergences) and agrees with the UTF-8 path on the reject decision; previously-valid inputs are unchanged.
• Full suite: 193/193 (191 existing + 2 new).

[blakeembrey]

LGTM, but can you correct the formatting so tests pass?

[blakeembrey]

Prefer to return early, e.g. if (idx + 2 > str.length || !isHexDegit(...) || ...) return undefined first and avoid the need for an else.

[spokodev]

Done - the failing check was prettier on the new test line; reformatted it (single quote + wrapped to printWidth), no logic change. Tests pass now.