Add opt-in Blob, File and FormData

[lahma]

Part of the opt-in web API series (#3079): Blob, File and FormData behind WebApiFeatures.Files (in Default). These are prerequisites for fetch's body model. Usual rules: BCL only, net8+, opt-in, default engine unchanged.

• Blob (https://w3c.github.io/FileAPI/): byte[]-backed and immutable; the constructor's blob-parts processing is fused with the WebIDL sequence conversion so element coercion order stays observable; media-type normalization per spec; slice with negative-index clamping; text()/arrayBuffer()/bytes() return real (already-resolved) promises. endings: "native" is accepted but behaves as "transparent" — honouring it would make a blob's bytes (and any hash or request body over them) depend on the host OS; unknown enum values still throw TypeError per WebIDL. stream() is absent (not throwing) until the streams campaign (Web API campaign: Streams and fetch body completion #3082).
• File extends Blob: name, lastModified — defaulting from the engine's ITimeSystem rather than DateTime.UtcNow, so it agrees with Date.now() and is deterministic under a host-installed clock.
• FormData (https://xhr.spec.whatwg.org/#interface-formdata): ordered entry list of string/File; append/set overload resolution on the value with three-argument string forms a TypeError (matches Chrome; resolution runs before argument conversion, pinned); a bare Blob value is wrapped into a File named "blob" per create-an-entry; set replaces in place; full iteration surface (entries/keys/values/@@iterator/forEach). The constructor takes no arguments here — a non-undefined argument is a TypeError, per the WinterTC caveat for runtimes without HTML forms. Multipart serialization deliberately lands with fetch, not here.

Two defects were caught by writing the failing test first (quoted pre-fix in the test comments): new File(undefined, 'a') silently building an empty file, and the WebIDL long long wrap folding lastModified: -1 to 0.

143 WebApi tests run on net10 (the net472 leg compiles none of this, proving the gate). Verified: all-TFM build, both suites × both frameworks × both host-contract-verification configurations.

🤖 Generated with Claude Code