Remove cookies with a non-positive Max-Age from sessions

[alutoin-cloudamite]

Dry run on the fork — please do not merge here. For proof-reading and to run HTTPie's
own CI before anything is proposed to httpie/cli. The body below is what the upstream PR
would say, minus this banner.

Found this with Claude, curated the fix with it, I hope it is acceptable.

Completes httpie#998, which reported that Max-Age=0 on its own never removed a cookie from the session
file. httpie#1029 fixed that by translating max-age into expires, gated on max_age.isdigit() — which
is False for negatives, so Max-Age=-1 still never gets an expires and the cookie is never
removed. HTTPie keeps sending a cookie the server asked it to delete.

RFC 6265 §5.2.2: "If delta-seconds is less than or equal to zero, let expiry-time be the earliest
representable date and time."

>>> from httpie.utils import get_expired_cookies
>>> get_expired_cookies('one=two; Max-Age=0; path=/', now=1000.0)
[{'name': 'one', 'path': '/'}]
>>> get_expired_cookies('one=two; Max-Age=-1; path=/', now=1000.0)
[]                                            # should also be expired

Change

-        if max_age and max_age.isdigit():
-            cookie['expires'] = now + float(max_age)
+        try:
+            delta_seconds = int(max_age)
+        except (TypeError, ValueError):
+            continue
+        cookie['expires'] = now + delta_seconds

int() is what http.cookiejar itself uses for max-age. A narrower lstrip('-').isdigit() would
make int('--1') raise; the new test pins that case.

Tests

Parametrized next to the existing Max-Age=0 test from httpie#1029 — 0, -1, -100, 3600, plus
''/abc/1.5/--1 for unparseable input. Fails on -1 and -100 before the change, 8 passed
after; full suite 994 passed.

CI will show red, but not from this change: test_cli_ui.py::test_naked_invocation and two
test_encoding.py big5 cases already fail on master at 5b604c3, and the 3.7 jobs can't install
Python 3.7 on current runners. code-style passes — I ran the workflows on a fork first.

Why not just delete the workaround

Its HACK/FIXME points at psf/requests#5743, which is closed as a no-op, so no upstream change is
coming. I measured whether it is still needed: with get_expired_cookies() disabled, current-format
sessions still drop the cookie — the cookiejar manages it now that cookies are domain-bound (httpie#1312) —
but pre-3.1.0 dict-layout sessions keep it. Deleting would therefore reintroduce httpie#998 for any
session not yet upgraded, so this fixes it in place. The docstring is rewritten to record that, since
the missing context is what let the bug survive httpie#1029.

No CHANGELOG entry, but happy to add one in whatever form you would like.

[alutoin-cloudamite]

Superseded by httpie#1914. Kept the branch; this dry run served its purpose (proof-reading and a real CI run before proposing upstream).