[Server][Tests] Complete the multi round-trip request flow (SEP-2322) (#446)

The revision has no way for a server to put a request on a response stream,
so a handler that needs input from the user says so in its result instead: a
handler returning InputRequiredResult comes back as
resultType: "input_required" with the asks and an opaque requestState, and
the client retries the same request carrying inputResponses.

RequestContext::getInputContext() is what the handler reads them through.
RequestStateCodec signs and time-bounds the state, so a tampered or expired
one is refused rather than trusted - the state travels through the client,
which is not a place to keep something the server later believes.

tests/Conformance/Fixtures/nginx.conf

@@ -3,10 +3,8 @@ server {
     server_name localhost;
     root /app;
 
-    # The two lifecycles are served side by side so one conformance run can
-    # target either without restarting the fixture: / speaks the handshake era
-    # (2025-11-25 and earlier), /stateless speaks the modern era (SEP-2575).
-    # Declared before `location /` so the prefix match wins.
+    # / speaks the handshake era, /stateless the modern one (SEP-2575).
+    # Declared first so the prefix match wins.
     location /stateless {
         try_files $uri /tests/Conformance/server-stateless.php$is_args$args;
     }