Cookie override via overbroad name trimming

Improper cookie-name validation in Hono before 4.12.12 allows remote attackers to override security-sensitive cookies through crafted names. The parse() utility applies JavaScript trim() to cookie names, stripping a leading U+00A0 non-breaking space that browsers preserve and collapsing two distinct names onto one key. Exploitation requires a way to set an attacker-controlled cookie, such as a man-in-the-middle position on a non-secure page or another injection vector; affected applications can suffer cookie-prefix bypass, session fixation, or session hijacking.