Add a new stream tokeniser & make it pass basic tests

First cut parsing strings with escapes; just validate, don't actually decode