nvx-rs: split the guest init's boot tokens with one function of protocol::cmdline #905

Summary

nvx::protocol::cmdline reads a kernel command line as Linux reads it, for the readers that need the kernel's view of it. The readers of the boot tokens that the guest's init consumes don't use it. Each splits the command line itself, at spaces, tabs, and newlines, without quoting, as guest/common/init splits it, and takes a token's name up to its first =. The same loop is copied four times:

• HostExport::parse, nvx-rs/src/protocol/export.rs:118-127: the host export's virtfs_* tokens, and nvx_share=.
• RootLayout::parse, nvx-rs/src/protocol/root.rs:205-213: a layered root's tokens. It already reads the virtio_mmio.device parameters through cmdline::virtio_mmio_devices.
• parse_host_mapping_count, nvx-rs/src/protocol/boot.rs:22-25: nvx_maps=.
• cmdline_requests_report_only, nvx-rs/src/guest/time/api.rs:173-179: nvx_time_abi=report-only.

The kernel's rules, cmdline::parameters, cannot replace these copies as they stand. They split at more bytes, honor double quotes, stop at --, and match - with _ in names, so they would read some command lines differently from init. tests/fixtures/export-tokens.json and tests/fixtures/root-tokens.json pin that every reader of those tokens agrees.

Raised in a review of #875.

Proposal

• Add to protocol::cmdline a function that splits a command line as the guest's init does, at spaces, tabs, and newlines, without quoting, and returns its tokens with their names up to the first = and their values after it. The module's documentation names both sets of rules and the readers that take each.
• HostExport::parse, RootLayout::parse, and parse_host_mapping_count read their tokens through it, and drop their own copies of the split.
• The time ABI's report-only token is read through protocol::cmdline too: with the init's rules, or with the kernel's if nvx-rs: kernel command-line checks split parameters differently from Linux #723 moves the guest's time ABI checks to them.
• Tests of the new function in protocol/cmdline/tests.rs: empty tokens, a token without =, a token that starts with =, a value that holds =, and the bytes at which it does not split, such as \r, 0x0b, 0x0c, 0xa0, and ".

Acceptance criteria

• No behavior change. The cases of tests/fixtures/export-tokens.json and tests/fixtures/root-tokens.json, host_mapping_count_matches_the_guest_command_line_parser, and the existing tests pass unchanged.
• The init's split exists once in nvx-rs/src, in protocol::cmdline.
• protocol still needs nothing outside the standard library, so the host, the guest, and test doubles still share it.