Use UrlLib transport fixes branch

[CedricGuillemet]

Summary

Pin UrlLib's CMake GIT_TAG to 81ea0404f6d719e2bc306c20d99594c30c434b19 from BabylonJS/UrlLib#39.

This includes Windows and Apple transport fixes, shared data URL decoding, and the Android raw-byte POST fix. The exact commit pin makes consumer builds reproducible while the upstream change remains under review. Keep this PR in draft pending the upstream dependency review.

Consumer regression coverage

Add 83 JavaScript scenarios exercising the real Fetch and XMLHttpRequest polyfills:

• POST Content-Type casing via records, header-pair arrays, and response Headers-like objects; exact MIME parameters and omitted MIME; empty, UTF-8, and embedded-NUL string bodies. Verify received wire bytes and consume responses as JSON, text, ArrayBuffer, and Blob.
• Invalid Windows MIME failures and reopening an XHR without stale request headers.
• Responses without Content-Type, including empty/204 bodies and both XHR response modes; preserve existing Windows success normalization and HTTP 404/500/304 behavior.
• Shared data URLs: percent/base64 decoding, MIME/defaults, all 256 byte values, PNG signatures, UTF-8/NUL text, JSON, fragments, malformed input with explicit diagnostics and no partial response, unsupported POST, aborts, and XHR reuse across data/HTTP transports.

HTTP scenarios use an in-process ephemeral loopback server, not an external service. The fixture bounds socket operations and reports worker failures. Wire the fixture into desktop and Android test builds and enable local HTTP in the mobile test apps. Support targeted runs through JSRUNTIMEHOST_TEST_GREP; unmatched filters fail explicitly.

Local validation

Windows

Windows x64, Visual Studio 2026, RelWithDebInfo, at the earlier UrlLib review revision 4dabd8dbd65d7406bf80d9c5b3f8d2108b0e17ef (the new pin changes only Android source and documentation):

Engine	New scenarios	Full JavaScript suite	Full native GoogleTest run
QuickJS	83 passing, three consecutive runs	334 passing, 3 existing pending	25 passing
V8	83 passing, three consecutive runs	333 passing, 4 existing pending	32 passing, 1 existing skip

The native counts include JavaScript.All, which runs the JavaScript suite. The full suites also retain their pre-existing public-network tests. Verified that a filter matching no tests fails rather than returning a false success.

Android: physical Pixel 9a

QuickJS ARM64, Android 17 / API 37, NDK 28.2.13676358:

• Reproduced the previous CI run's Android failure locally: 317 passing, 3 pending, 14 failing, followed by a QuickJS runtime teardown assertion.
• Temporary diagnostics proved a 22-byte POST body became an empty Java string through NewStringUTF, producing content-length promised 22 bytes, but received 0. The four NUL POST failures were followed by loopback-fixture timeouts and teardown failure.
• UrlLib now writes raw byte-array chunks to OutputStream, preserving NULs and UTF-8 without changing AndroidExtensions.
• The unchanged full suite passes with the fix: 331 JavaScript passing, 3 existing pending; all 24 native tests passing; instrumentation OK (1 test), with no teardown crash.
• Verified once against the local fix, then removed the source override, fetched the published pin, rebuilt, and repeated the full successful run. No XHR implementation changes, fixture changes, test weakening, or diagnostic patches were needed for this fix.

Windows negative controls

Rebuilt the consumer tests against the previous UrlLib pin, 0c991337a1160ba7a2d062bf8e342d0a66f48dc9, using a CMake source override:

• POST group: 17 failing, 0 passing, exposing header-name failures, injected/duplicated charset parameters, and omitted MIME changes.
• Data URL group: 51 failing, 3 passing; failures cover decoding and explicit shared-scheme diagnostics.
• Isolated missing-response-Content-Type Fetch case: process access violation 0xC0000005, reproducing the old Windows crash.

Removed the override, rebuilt against the fixed review revision, and reran the full QuickJS suite successfully.

Platform and scope limits

Local consumer execution covers Windows QuickJS/V8 and Android QuickJS. Independently verified UrlLib's hosted CI at the earlier Windows-tested revision: Windows, Linux GCC/Clang, and macOS were green. Its macOS job passed all 54 native tests, including Content-Type casing/parameters, omitted MIME, and raw POST byte preservation. These earlier results do not substitute for CI on the new pin.

Linux consumer POST scenarios explicitly skip because that backend does not implement POST. Fetch/XHR currently accept only string request bodies; invalid-UTF-8 POST bytes remain covered by UrlLib's Windows/Apple native tests, while these consumer tests cover embedded NULs and UTF-8 strings. Apple consumer execution, other Android engines, and GPU/image rendering were not locally validated. The fixture declares UTF-8 echo responses and uses lowercase diagnostic response header names to avoid asserting unrelated platform charset/header-normalization behavior.