o Make no assumptions about eof(), other than that it is somewhere
  outside of the valid range of char_type.

o We can retain -Weffc++ and specify default initializers by using
  initializer lists.  The risks are low (of additional non-conformat
  compilers), because there is already one other such initialization
  used in the code-base.

o An (-'ve valued, typically -1) EOF must never be allowed in
  token_string, as it be converted to 255 -- a legitimate value.
o Comparing against a specific eof() (-1, typically) is more costly than
  detecting +'ve/-'ve.  Since EOF is the only non-positive value allowed
  we can use the simpler test.
o Removed unnecessary test for token_string size, as it is already
  tested in the method, and must never occur in correct code; used an
  assert instead.

o Return its contents when necessary.  In many cases, this avoids
  construction of multiple copies of the yytext token.  Exceeds
  performance of current develop branch.

o Use std::streambuf I/O instead of std::istream; does not maintain
  (unused) istream flags.
o Further simplify get/unget handling.
o Restore original handling of NUL in input stream; ignored during
  token_string escaping.

using more CMake

Add info for the vcpkg package.