+htp #16516 rewrite Deflate/GzipDecompressor as StatefulStage to defuse zip bomb

The GzipDecompressor now looks quite nice, very similar to the one before, but it was quite a ride to get there... Thanks to quite a good test coverage I'm somewhat confident it's now correct.

/cc @sirthias
What's the cost? That we need to reparse the prefix? Or that we throw an exception? All of that is dwarfed by the need to pull new data asynchronously in the case where the exception is thrown.