Remove cookies with a non-positive Max-Age from sessions

[alutoin-cloudamite]

Found this with Claude, curated the fix with it, I hope it is acceptable.

Completes #998, which reported that Max-Age=0 on its own never removed a cookie from the session
file. #1029 fixed that by translating max-age into expires, gated on max_age.isdigit() — which
is False for negatives, so Max-Age=-1 still never gets an expires and the cookie is never
removed. HTTPie keeps sending a cookie the server asked it to delete.

RFC 6265 §5.2.2: "If delta-seconds is less than or equal to zero, let expiry-time be the earliest
representable date and time."

>>> from httpie.utils import get_expired_cookies
>>> get_expired_cookies('one=two; Max-Age=0; path=/', now=1000.0)
[{'name': 'one', 'path': '/'}]
>>> get_expired_cookies('one=two; Max-Age=-1; path=/', now=1000.0)
[]                                            # should also be expired

Change

-        if max_age and max_age.isdigit():
-            cookie['expires'] = now + float(max_age)
+        try:
+            delta_seconds = int(max_age)
+        except (TypeError, ValueError):
+            continue
+        cookie['expires'] = now + delta_seconds

int() is what http.cookiejar itself uses for max-age. A narrower lstrip('-').isdigit() would
make int('--1') raise; the new test pins that case.

Tests

Parametrized next to the existing Max-Age=0 test from #1029 — 0, -1, -100, 3600, plus
''/abc/1.5/--1 for unparseable input. Fails on -1 and -100 before the change, 8 passed
after; full suite 994 passed.

CI will show red, but not from this change: test_cli_ui.py::test_naked_invocation and two
test_encoding.py big5 cases already fail on master at 5b604c3, and the 3.7 jobs can't install
Python 3.7 on current runners. code-style passes — I ran the workflows on a fork first.

Why not just delete the workaround

Its HACK/FIXME points at psf/requests#5743, which is closed as a no-op, so no upstream change is
coming. I measured whether it is still needed: with get_expired_cookies() disabled, current-format
sessions still drop the cookie — the cookiejar manages it now that cookies are domain-bound (#1312) —
but pre-3.1.0 dict-layout sessions keep it. Deleting would therefore reintroduce #998 for any
session not yet upgraded, so this fixes it in place. The docstring is rewritten to record that, since
the missing context is what let the bug survive #1029.

No CHANGELOG entry, but happy to add one in whatever form you would like.