This one is technically observable, isn't it? Like what if I had crappy code that expected the BOM there

Re-opening this. The change is necessary to improve correctness and spec compliance.

changes:

• Changed the compat flag. Added a new one specific to this with an implied by pedanticWpt
• Changed the public API to remove the option. It is still there internally in streams but it doesn't surface all the way out to http.c++, for instance
• Fixed up one minor pointer arithmetic bit to rely more on the safer kj apis
• Other minor tweaks to ensure tests pass.

@npaun and @kentonv ... if either or both of you could review this again, I'd appreciate it. I can no longer do the sign off since it includes my own changes.