refactor(utls): modularize stream.rs into focused stream/ submodules (#108)

[vxfemboy]

Summary

Addresses Issue #108 (Part 2) by modularizing the monolithic crates/yip-utls/src/stream.rs (~3,450 lines) into a focused module directory crates/yip-utls/src/stream/:

• record.rs: Record-layer codecs, record_header, find_finished_end, and record constants (CONTENT_TYPE_*, RECORD_HEADER_LEN, LEGACY_RECORD_VERSION*, MAX_*).
• cert.rs: Certificate chain parsing, leaf extraction, and SPKI public key extraction (CertFlightInfo, scan_cert_flight, certificate_chain_ders, spki_sec1_pubkey_from_der).
• sig.rs: Signature verification, sign_certificate_verify, and verify_reality_binding.
• flight.rs: Flight shape scanning, greedy record framing, and synthetic server flight emission (FlightShapeScan, scan_flight_shape, ServerFlight, emit_server_flight).
• mod.rs: Async I/O stream orchestration (connect, serve, capture_dest_flight, RealityStream), RNG adapters, and re-exports.
• tests.rs: Mock server test fixtures, loopback end-to-end handshakes, and verification tests.

Invariants & Compatibility

• Zero Wire Format / Protocol Changes: All client/server handshakes, transcript hashing, and record framing remain 100% byte-for-byte identical.
• 100% Backward Compatibility: All public exports (yip_utls::connect, yip_utls::capture_dest_flight, yip_utls::RealityStream, yip_utls::stream::serve, yip_utls::stream::scan_flight_shape, yip_utls::stream::emit_server_flight, yip_utls::stream::sign_certificate_verify, FlightShapeScan, ServerFlight) retain identical paths and signatures.
• Safety: Strictly preserves #![forbid(unsafe_code)] with zero unsafe blocks.

Verification

• cargo test --all: All 351 unit tests and 42 integration/netns tests pass.
• cargo clippy --all-targets -- -D warnings: 0 warnings across workspace.
• cargo fmt --check: Clean formatting.
• cargo deny check: Advisories, bans, licenses, and sources all OK.