Move the `fs.existsSync(indexPath)` check below the `--no-download`
early return: in that mode the check is unused (the read after
refreshIndex already validates existence), so it's wasted disk I/O.
Address two CodeQL findings on the per-test index downloader:
- "File data in outbound network request": validate the cached ETag
against the RFC 7232 grammar before sending it as If-None-Match, so
the cache file's contents can't be injected into the request header.
- "Network data written to file": cache the re-serialized JSON
(JSON.stringify(JSON.parse(...))) instead of the raw response body,
so only well-formed JSON produced by our own serializer is written.
`coverage_search` now fetches `per-test-index.json` from the pdf.js.refs
gh-pages branch, caches it locally, and only re-downloads it (via ETag)
when it changed, so querying which ref tests cover a line/function no
longer needs a local `--coverage-per-test` build. `--no-download` reuses
the cached index offline and `--index` points at a local one.
`browsertest` and `makeref` accept the same `--code` filter to run (or
regenerate refs for) only the covering tests, dropping any covered IDs
that aren't in this branch's manifest so the run isn't rejected.
