feat(protocol): add bounded Block1 POST uploads

[Jason-Morcos]

Summary

• keep POST bodies through 1024 bytes on the existing single-frame path
• upload larger bodies with token-stable Block1 requests and Size1 on the first block
• honor a server-requested smaller block size by byte offset
• reject incomplete, contradictory, oversized, or unbounded transfers with the package's typed errors
• keep URI queries and extension options on every block

Why

Samsung's IoTivity server does not reconstruct an oversized CoAP message split across DTLS application-data records. Credential and ownership payloads larger than one 1024-byte OCF block therefore need atomic Block1 framing, with the same token across the complete upload.

This carries the behavior used by my working local-appliance Home Assistant integration into the shared transport while preserving the package's error taxonomy and fixed error messages.

Stack / merge order

1. fix(protocol): pace CoAP request sends #51 owns request and OBSERVE-registration pacing.
2. feat(protocol): validate GET and POST request options #48 adds validated query and extension options.
3. feat(protocol): add CoAP DELETE requests #49 adds DELETE.
4. feat(protocol): add bounded Block1 POST uploads #50 (this PR) adds bounded Block1 POST uploads.

Please review this after #49. The Block1-only commit is b7a8f81.

Validation

• 325 SmartThings-Local tests on current dependencies and the Python 3.11 dependency floor
• 1,625 LocalThings tests against this exact source tree
• exact and partial block boundaries, size downshift, stale acknowledgements, identical retransmission, deadline, cleanup, request-cap, and payload-cap coverage
• current Home Assistant transport/resilience regressions rechecked against the same request behavior
• wheel and sdist content checks plus isolated install/import smoke tests
• bytecode compilation and share-safety checks

[QuiteYellow]

Not reviewed yet, same as #48. #56 holds the order.

The claim I want to confirm on hardware before this lands is the motivating one: that Samsung's IoTivity server will not reconstruct an oversized CoAP message split across DTLS application-data records, so a body over one 1024-byte block needs Block1 framing with a stable token. If you have a capture of the failure without Block1, link it. I have a dryer and an oven I can try it against.

Like #49 this stays on the transport side of #28. Block1 framing is a primitive; the credential and ownership payloads that motivate it are a separate question.