fix(curl-impersonate): treat a refused CONNECT tunnel as a proxy error (#2109)

`curl-cffi` 0.16.0 broke two things in `CurlImpersonateHttpClient`,
which is why #2107 capped it. This fixes both and drops the cap.

1. Bundled libcurl went 8.15.0 -> 8.21.0, so a refused CONNECT tunnel is
now `CURLE_COULDNT_CONNECT` with `CONNECT tunnel failed` instead of
`CURLE_RECV_ERROR`. `curl_cffi` maps only the latter to
`CurlProxyError`, so `_is_proxy_error` stopped recognizing it and
sessions were not rotated. The needle lives in `_curl_impersonate.py`
rather than the shared `ROTATE_PROXY_ERRORS`, which mirrors the JS
Crawlee list - impit and httpx never produce libcurl messages.

2. The session cookie write path moved to
`Cookies.update_cookies_from_curl_changes`, leaving the `_EmptyCookies`
override inert. Isolation held (`get_cookies_for_curl` is still
overridden, so nothing was ever sent), but every response cookie
accumulated in the jar of the per-proxy session cached for the client's
lifetime. Measured with the same 25-request repro: 25 cookies on 0.16.0,
0 on 0.15.0.

The existing `test_crawl_with_proxy_disabled[curl]` and
`test_send_request_with_proxy_disabled[curl]` cover the first;
`test_internal_session_cookie_jar_stays_empty` is new for the second.

Closes: #2111

*✍️ Drafted by Claude Code*