Random bounds and cookie files behave as written

This release makes two flags of atra (Atrahasis CLI) do exactly what the command line says, and say so when they cannot.

• A bound the generator cannot use is refused, not guessed. A {{random.number(min,max)}} bound that did not fit, or was not a number, used to fall back silently to the default range; a range written backwards, number(9,1), stopped the process; an empty enum() sent an empty string. Each of these now stops the run before anything is sent, with a message that names the placeholder and the argument. A blank argument still means the default.
• -b @cookies.txt reads the file. The spelling the help promises sent the literal text @cookies.txt as the Cookie header and read nothing. -b cookies.txt read the file but also sent the path itself as a second Cookie header. One rule now: @path names a file, and so does a plain path to a file that exists; anything else is sent as the cookie string.
• A file's cookies are sent once. They go through the cookie jar, matched against the request host, and a missing @file stops the run and names the file.

A command that relied on a silently defaulted random bound will now stop and say which argument to correct. Nothing else needs to change.