[CVE-2025-49007]

There is a ReDoS in multipart parsing here because it is not anchored to
the start of a line and so may match as part of its comments.

Previously in f92e056 Content-ID and
Content-Type were changed to only accept tab and space as whitespace
characters. Although that's what the various RFCs show as their BNF,
I that's supposed to be interpreted _after_ lines have been unfolded and
so we need to allow FWS "Foldable White Space".

CR is not allowed unescaped as part of quoted-string. It might be
technically valid with a leading backslash, but I don't believe that
case is worth supporting.

Co-authored-by: Matthew Draper <matthew@trebex.net>