both the impl and the spec look very nice!

one possible improvement: document FFI. things like: "how to test it". this is what I did:

cmake .
make

This generated a binary test which indeed runs the test. but I can see there is also a run script, which is trying to execute ./build/test. But my binary is in the working dir, not inside build.

this is no biggie, but documenting the blessed steps how to run the test would be nice.

(after writing all of the above, I noticed there is the compile script shows everything. and this script is used on CI. so I guess a sentence in FFI readme will do)

I realized it's actually overly restrictive - we do need underscore in keys. right now, the grammar does not make it possible. and indeed, this is failing:

#[test]
fn key_with_underscore() {
    let input = "https::addr=localhost;tls_roots=/etc/ssl/certs/ca-certificates.crt;";
    let config = parse_conf_str(input);
    assert!(!config.is_err());
}