Parser: parse the "for" initializer once

Parser: parse the "for" initializer once

Previously, the initializer was parsed twice: speculatively as a
LeftHandSideExpression so that the token after it could be inspected, and
then the rest of the expression was grafted onto that left-hand side by four
continuation states.  A dispatch list and an arrow pre-check existed only to
keep inputs away from the speculative parse.

The fix is to let [~In] end the initializer: the "in" operator is no longer
part of the expression, so the header is a single <Expression> and
njs_parser_for_var_in_of_expression(), which already classified the other
routes, classifies this one too.  Its post-hoc for-in detection goes with it.

A declaration header stopping at "in" now reports an invalid target instead
of an unexpected token:

    for (var a, b in []);

The first token's text was carried through the header only to be quoted in
the removed diagnostic, so the allocation goes with it.