Harden builtins against resource exhaustion and panics

[anakrish]

Summary

Harden builtin implementations against attacker-controlled memory/CPU exhaustion and runtime panics.

Changes

• Validate numeric range steps and arithmetic before allocation; bound generated ranges.
• Bound large bitwise left shifts.
• Replace recursive graph traversals with iterative traversal.
• Add recursion-depth guards to JSON patch and object operations.
• Improve object.union_n accumulation.
• Enforce output-growth limits in string, regex, and JSON builtins.
• Handle empty-substring strings.count safely.
• Bound and safely parse sprintf widths.
• Add depth limits for builtin comparisons, sorting, max, and min.
• Guard numeric parsing of oversized values.
• Add regression tests for hardened behavior.

Validation

• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --lib --features allocator-memory-limits -- --test-threads=1
• cargo test --workspace --exclude ensure_no_std
• cargo test --no-default-features --lib
• cargo xtask ci-debug

The branch contains five focused commits, including a final commit for unrelated Clippy fixes required by all-features validation.