fix: keep hexadecimal escape terminators inside words

[feritcemkahraman]

CSS hexadecimal escapes may consume up to six hexadecimal digits followed by one optional whitespace terminator. Currently fo\a o becomes three nodes, so consumers can treat a single CSS identifier as multiple values.

Consume the optional terminator while scanning words, preserving the original spelling and source offsets. Handle CRLF as one newline, leave subsequent whitespace as a separator, and keep punctuation after an escape available to the parser. This also corrects the existing Hawaii \35 -0 fixture: \35 -0 is one identifier.

Addresses the word-tokenization case in #64. Escape decoding in string values is outside this change.

Validation:

• Before the fix, 8 of the 9 new regression cases fail.
• pnpm test: all 175 tests pass.
• pnpm lint: passes.
• pnpm exec oxfmt lib/parse.js test/parse.js test/hex-escapes.js: applied.
• git diff --check: passes.

Specification: https://www.w3.org/TR/css-syntax-3/#consume-escaped-code-point