fix(isMailtoURI): decode recipient addresses before validation

[FanWu-ai]

isMailtoURI rejects addresses on percent-encoded internationalized domains. For example, the URI from RFC 6068 §6.3 currently returns false:

isMailtoURI('mailto:user@%E7%B4%8D%E8%B1%86.example.org?subject=Test&body=NATTO');

Decode each recipient once after parsing the URI delimiters, then pass the decoded address to isEmail. This also makes malformed percent-encoding return false and applies existing email options to the actual recipient address. Reject decoded C0 and DEL controls before email validation, as required by RFC 6068 §2. Literal and encoded plus signs, escaped percent signs, and printable quoted local parts remain supported.

The regression tests cover direct recipients, cc/bcc, internationalized domains, encoded local parts, malformed encoding, and existing email options. No public API or option changes.

Validation on Node.js 24.19.0:

• Full unchanged baseline npm test: 323 passing.
• Full test run with regression tests and original source: 324 passing, 3 failing.
• Final npm test: 327 passing, including all builds, minification, ESLint and coverage.
• 1,566 additional assertions across source, CommonJS entry point/individual module, ES output, browser bundle and minified browser bundle.
• git diff --check passed.

AI assistance was used to prepare the implementation and regression tests.

Checklist

• PR contains only related source and regression-test changes
• README reviewed; existing API and options are unchanged
• Regression tests added
• Primary reference provided