fix: handle BOM in iterator APIs

[niyue]

Summary

Fixes #168 by ignoring a UTF-8 BOM when .env content is consumed through the iterator APIs.

Changes

• Strip the BOM from the first decoded line in the shared iterator path.
• Apply the same behavior to from_read_iter, from_path_iter, and the existing loading APIs.
• Handle readers that return the BOM bytes across multiple reads.
• Add regression tests for both public iterator APIs.
• Document the fix in the changelog.

How to verify

cargo test --workspace