Harden legacy RingCT prunable deserialization against oversized output counts

[MoneroOcean]

Motivation

• The RingCT prunable deserializer can call vec.resize(outputs) using an attacker-controlled outputs count obtained from a parsed transaction prefix, enabling large allocations and OOM when parsing untrusted block blobs.
• Rather than changing transaction-version acceptance, the change hardens the reachable deserialization path to reject unreasonable legacy RingCT output counts before any vector resizing occurs.

Description

• Add a constant MAX_LEGACY_RINGCT_OUTPUTS = 1024 in rct namespace to bound legacy (non-bulletproof) RingCT outputs.
• Insert an early check if (outputs > MAX_LEGACY_RINGCT_OUTPUTS) return false; in rctSigPrunable::serialize_rctsig_prunable before PREPARE_CUSTOM_VECTOR_SERIALIZATION(outputs, rangeSigs); to prevent oversized rangeSigs allocations.
• Keep existing behavior for bulletproof, bulletproof+, and other RingCT paths unchanged.

Testing

• Attempted to run the repository test suite with npm test, but it failed due to external registry access returning 403 Forbidden for https://registry.npmjs.org/bech32, so automated tests could not be completed in this environment.
• No unit test failures attributable to the change were observed locally because the test run could not proceed to completion due to the registry error.

---

Codex Task